Stored XSS Vulnerability in SiYuan Asset Preview Feature

CVE-2026-87814

What is CVE-2026-87814?

SiYuan prior to version 3.8.2 is vulnerable to a stored cross-site scripting (XSS) risk. This issue arises within the search asset preview functionality where the indexed asset content is improperly handled. Specifically, attacks can succeed due to the failure to escape content before inserting it into the Document Object Model (DOM) using innerHTML. Malicious actors capable of uploading crafted text assets to a workspace can leverage this flaw to execute JavaScript in the context of the SiYuan application when victims review these assets. This could lead to unauthorized API calls and manipulation of the workspace.

References