CVE-2026-87813 — SiYuan before v3.8.2 Stored XSS via unescaped asset filenames
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Aut…
Published: 2026-09-09 · CVSS: 8.4 · CVSS 4.0
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's browser when searching assets, enabling same-origin API requests and application state manipulation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7