Stored Cross-Site Scripting Vulnerability in SiYuan by SiYuan Note
CVE-2026-87812

7.4HIGH

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
9 September 2026

What is CVE-2026-87812?

SiYuan prior to version 3.8.2 is susceptible to a stored cross-site scripting (XSS) vulnerability within the Bazaar package cards. This flaw arises from the improper handling of the iconURL metadata, which gets directly inserted into HTML img src attributes without adequate escaping. Malicious actors can exploit this vulnerability to inject harmful URLs equipped with JavaScript event handlers. When users interact with Bazaar listings, these injected scripts can execute within the authenticated SiYuan environment, leading to unauthorized API requests and manipulation of the application's state.

Affected Version(s)

siyuan 0 < 3.8.2

siyuan 3.8.2

References

https://github.com/siyuan-note/siyuan/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/siyuan-before-3.8.2-...
third-party-advisory

CVSS V4

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.