HIGH 8.4 NVD
CVE-2026-87813
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML with
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's browser when searching assets, enabling same-origin API requests and application state manipulation.
References
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qcw6-qm34-28h8
- https://www.vulncheck.com/advisories/siyuan-before-3.8.2-stored-xss-via-unescaped-asset-fi
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qcw6-qm34-28h8
This high severity vulnerability with a CVSS score of 8.4 was published on 2026-09-09 via NVD.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.