CVE-2026-87813

SiYuan before v3.8.2 contains a stored cross-site scripting (XSS) flaw in the Search Assets result list, where asset filenames are interpolated into HTML without escaping (CWE-79). An authenticated attacker plants an asset whose filename contains malicious markup; when a victim performs an asset search, that markup executes as JavaScript in the victim's browser. Successful exploitation allows the attacker to make same-origin API requests as the victim and manipulate application state, but does not impact confidentiality or integrity beyond the application scope per the CVSS scoring. All SiYuan deployments running versions prior to 3.8.2 are affected, particularly multi-user or shared instances where one user can upload assets viewed by others. There is currently no known public proof-of-concept, no CISA KEV listing, and no confirmed in-the-wild exploitation.

What to do: Upgrade SiYuan to version 3.8.2 or later to remediate the flaw. Until patched, limit asset uploads to trusted users and avoid performing asset searches as a highly privileged user on shared or internet-exposed instances. Administrators should review uploaded asset filenames for embedded markup and consider whether their instance is exposed beyond localhost.