CVE-2026-87811

SiYuan versions before 3.8.2 fail to properly encode persisted notebook template paths when they are inserted into HTML input value attributes, resulting in cross-site scripting (CWE-79). An authenticated attacker with low privileges can save a notebook with a crafted template path containing attribute-breaking characters; when a victim later opens that notebook's configuration, the injected content breaks out of the attribute and executes attacker-controlled JavaScript in the victim's browser session. From there, the attacker can issue same-origin API requests as the victim and manipulate application state. All SiYuan deployments running a version prior to 3.8.2 are affected, with the greatest risk in multi-user or web-accessible instances where another account can modify notebook settings. There is currently no public proof of concept, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Upgrade SiYuan to v3.8.2 or later, which applies proper attribute encoding for notebook template paths. Until patched, restrict write access to notebook settings to trusted accounts, limit web UI access to trusted networks, and review existing notebooks for template paths containing quotes or HTML metacharacters that could have been used to plant persistent payloads.