CVE-2026-87813
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's browser when searching assets, enabling same-origin API requests and application state manipulation.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.4
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- CWE
- CWE-79
- Published
- 2026-09-09
- Last modified
- 2026-09-09
Affected products
- siyuan-note siyuan
- siyuan-note siyuan
Weakness type
Related vulnerabilities
- CVE-2026-54694 — NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover
- CVE-2026-18147 — Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url
- CVE-2026-86772 — Snipe-IT 8.6.3 Stored XSS via Department Names
- CVE-2026-87814 — SiYuan before v3.8.2 Stored XSS via Asset Preview
- CVE-2026-87812 — SiYuan before v3.8.2 Stored XSS via Bazaar iconURL
- CVE-2026-87811 — SiYuan before v3.8.2 Stored XSS via notebook template paths
- CVE-2025-3271 — DOM-based XSS vulnerability in OpenText™ Documentum Webtop
- CVE-2026-14989 — Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter