CVE-2026-87814

HIGH 7.3

SiYuan before v3.8.2 Stored XSS via Asset Preview

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYuan origin when victims preview the assets, enabling authenticated API requests and workspace manipulation.

CWE	CWE-79
Vendor	siyuan-note
Product	siyuan
Published	Sep 9, 2026

Stay Ahead of the Next One

Get instant alerts for siyuan-note siyuan

Be the first to know when new high vulnerabilities affecting siyuan-note siyuan are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

siyuan-note / siyuan

0 < 3.8.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-64gp-333q-mq6j vulncheck.com: https://www.vulncheck.com/advisories/siyuan-before-3.8.2-stored-xss-via-asset-preview

Credits

🔍 alham-rizvi