CVE-2026-87814

SiYuan before v3.8.2 contains a stored cross-site scripting flaw (CWE-79) in its search asset preview feature: indexed asset content is inserted into the DOM via innerHTML without HTML escaping, so any markup in a text asset is rendered as HTML. An attacker who can place a crafted text asset in a workspace — for example, in a shared or team workspace where others open the content — triggers the flaw when a victim previews that asset from search results, and the injected JavaScript runs in the SiYuan origin. Because the script executes with the victim's session, the attacker can issue authenticated API requests as the victim and manipulate the workspace, though CVSS indicates no compromise of the system's integrity beyond that scope. Any user or deployment of SiYuan older than 3.8.2 is affected, with risk concentrated in workspaces where content can be authored by someone other than the user doing the preview. Exploitation has not been observed: the issue is not in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade SiYuan to v3.8.2 or later to get the escaped/encoded rendering fix. Until then, do not preview text assets of unknown origin from search results, restrict who can add assets to shared or team workspaces, and treat workspace content from untrusted collaborators as potentially attacker-controlled.