CVE-2026-87814 in SiYuan
Summary
by MITRE • 09/09/2026
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYuan origin when victims preview the assets, enabling authenticated API requests and workspace manipulation.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in versions of SiYuan prior to v3.8.2 represents a critical stored cross-site scripting flaw located within the search asset preview functionality. This security defect stems from an improper neutralization of special elements used by web browsers, specifically categorized under CWE-79: Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The root cause lies in the application's failure to properly escape or sanitize indexed asset content before injecting it into the Document Object Model using the innerHTML property. By directly inserting unescaped user-controlled data into the DOM, the browser interprets embedded script tags and event handlers as executable code rather than static text, thereby allowing malicious scripts to run within the context of the SiYuan application origin.
The operational impact of this vulnerability is significant because it enables authenticated attackers who have the ability to place crafted text assets within a user's workspace to execute arbitrary JavaScript code in the victim's browser session. Since the script executes with the same privileges as legitimate application scripts, an attacker can perform actions that are typically restricted to authorized users. This includes making authenticated API requests on behalf of the victim, which allows for unauthorized data access or modification. Furthermore, attackers can manipulate the workspace environment by altering UI elements, stealing sensitive information such as session cookies or authentication tokens, and potentially redirecting victims to malicious external sites through phishing techniques facilitated by the trusted origin context.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059.007: Command and Scripting Interpreter: JavaScript, which describes how attackers use scripting languages to execute commands within an application's environment. The stored nature of the payload means that the malicious code persists in the database or file system until manually removed, increasing the likelihood of exploitation against multiple users who access the compromised workspace. This persistence mechanism distinguishes it from reflected XSS attacks and elevates the severity due to its potential for widespread impact without requiring immediate user interaction beyond viewing the affected asset.
To mitigate this vulnerability, organizations using SiYuan must upgrade immediately to version v3.8.2 or later where the issue has been resolved through improved input validation and output encoding practices. Developers should implement strict Content Security Policy headers to restrict script execution sources and prevent inline scripts from running unless explicitly allowed via nonces or hashes. Additionally, adopting a whitelist-based approach for permitted HTML tags and attributes during sanitization processes can significantly reduce the attack surface. Regular security audits focusing on DOM manipulation methods like innerHTML are essential to ensure that all dynamic content insertion points properly encode special characters such as ampersands, less-than signs, greater-than signs, quotes, and apostrophes before rendering them in the browser environment.