CVE-2026-87812 — SiYuan before v3.8.2 Stored XSS via Bazaar iconURL
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes wi…
Published: 2026-09-09 · CVSS: 7.4 · CVSS 4.0
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated SiYuan origin when users view Bazaar listings, enabling API requests and application state manipulation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7