PT-2026-88952

CVE-2026-87814

Published

2026-09-09

Updated

2026-09-18

Description by

CVSS 4.0

8.4

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.2

Description A stored cross-site scripting issue exists in the search asset preview feature. The application fails to escape indexed asset content before inserting it into the Document Object Model (DOM) using the innerHTML property. This allows attackers who can place crafted text assets in a workspace to execute JavaScript within the SiYuan origin when a victim previews the assets, potentially leading to authenticated API requests and workspace manipulation.

Recommendations Update to version 3.8.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Alham-Rizvi

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers