CVE-2026-87811 in SiYuan
Summary
by MITRE • 09/09/2026
SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft malicious template paths that break out of the attribute context and execute JavaScript when a victim opens notebook configuration, enabling same-origin API requests and application state manipulation.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in SiYuan versions prior to 3.8.2 represents a classic Cross-Site Scripting (XSS) flaw rooted in improper input validation and output encoding within the web-based interface of the note-taking application. Specifically, the defect occurs when the system processes notebook template paths provided by users or stored in configuration files. Instead of applying appropriate HTML attribute encoding to these values before rendering them into HTML input elements, the software inserts the raw user-supplied data directly into the value attributes of form fields within the notebook configuration interface. This lack of sanitization allows an attacker who controls the content of a template path to inject malicious script payloads that are interpreted as executable code by the victim's web browser rather than being treated as static text.
From a technical perspective, this flaw aligns with CWE-79, which classifies improper neutralization of input during web page generation known as Cross-site Scripting. The specific mechanism involves breaking out of the HTML attribute context using crafted strings that include closing quotes and event handlers or script tags. When a victim opens their notebook configuration to view or edit settings, the browser parses the malformed HTML structure generated by SiYuan. Because the injected payload is embedded within an input value attribute without proper encoding, it escapes its intended scope and executes in the context of the application's origin. This execution environment grants the malicious script full access to the Document Object Model (DOM) and associated APIs available to that domain.
The operational impact of this vulnerability is significant due to the same-origin policy implications inherent in single-page applications like SiYuan. Once the JavaScript payload executes, it operates with the same privileges as legitimate application scripts. This enables attackers to perform unauthorized actions on behalf of the victim without requiring additional authentication steps beyond opening the configuration page. Potential consequences include stealing sensitive session cookies or local storage data that may contain user credentials or private notes, manipulating the application state by altering UI elements or form values, and making arbitrary same-origin API requests to backend services if such endpoints are accessible from the client side. In a desktop-electron hybrid context often used by SiYuan, this could potentially lead to broader system compromise depending on how the underlying webview handles script execution permissions.
This attack vector is categorized under MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter: JavaScript, as it involves executing code within a browser environment to achieve further objectives such as data exfiltration or persistence. The vulnerability highlights critical weaknesses in input handling practices where trust is placed on user-provided configuration paths without verifying their safety for HTML rendering contexts. It underscores the necessity of implementing strict output encoding strategies that map directly to the context in which data is being rendered, ensuring that special characters are escaped appropriately to prevent interpretation as code.
To mitigate this vulnerability and similar risks, developers must enforce rigorous input validation and output encoding protocols across all user-facing inputs. Specifically, any data inserted into HTML attributes must be encoded using methods such as HTML entity encoding or context-specific escaping libraries designed for JavaScript frameworks. Additionally, implementing Content Security Policy (CSP) headers can provide a layer of defense by restricting the sources from which scripts are allowed to execute, thereby limiting the impact even if an injection occurs. Users running affected versions should upgrade immediately to version 3.8.2 or later where this encoding issue has been resolved. Until then, avoiding the use of custom templates with untrusted paths and disabling JavaScript execution in embedded webviews can reduce exposure risk significantly.