CVE-2026-87812

SiYuan before v3.8.2 is vulnerable to a stored cross-site scripting flaw in its Bazaar package marketplace cards: the iconURL metadata of a package is inserted directly into HTML img src attributes without escaping. An attacker who controls the iconURL of a package (for example by publishing or modifying a marketplace entry) can inject a URL with event handlers such as onerror, and the payload executes when an authenticated user views the Bazaar listings. The injected JavaScript runs in the authenticated SiYuan origin, letting the attacker issue API requests as the victim and manipulate application state such as notes and settings. All SiYuan users running a version prior to 3.8.2 who browse the Bazaar marketplace are affected. No public proof-of-concept is known and the flaw is not in the CISA KEV catalog, so no exploitation is currently documented.

What to do: Upgrade to SiYuan v3.8.2 or later. Until patched, avoid browsing Bazaar listings and treat marketplace package metadata (including iconURL values) as untrusted, reviewing installed or published packages for unexpected icon URLs. No public proof-of-concept or in-the-wild exploitation is known at this time.