CVE-2026-87811 Overview
CVE-2026-87811 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in SiYuan, an open-source personal knowledge management application. Versions before v3.8.2 insert persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers with low-privilege access can craft malicious template paths that escape the attribute context and execute JavaScript when a victim opens the notebook configuration view. Successful exploitation enables same-origin API requests and application state manipulation against the SiYuan instance.
Critical Impact
Authenticated attackers can persist JavaScript payloads in notebook template paths and hijack a victim's SiYuan session to invoke same-origin APIs and modify application state.
Affected Products
- SiYuan note-taking application versions before v3.8.2
- Notebook configuration component processing template paths
- Deployments exposing the SiYuan web interface to multiple users
Discovery Timeline
- 2026-09-09 - CVE CVE-2026-87811 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87811
Vulnerability Analysis
SiYuan persists user-configurable notebook template paths and later renders them inside HTML input elements as the value attribute. The rendering path does not apply HTML attribute encoding to characters such as double quotes, allowing an attacker-controlled path to terminate the attribute and inject arbitrary attributes, including event handlers.
When a victim opens the notebook configuration interface, the browser parses the injected markup and executes the attacker's JavaScript in the origin of the SiYuan application. Because the payload runs in the authenticated user's context, it can call SiYuan's internal HTTP APIs, read notebook contents, and change application settings without additional authentication challenges.
The issue is a stored XSS rather than reflected, since the malicious template path is written to persistent notebook metadata. Any user who subsequently opens the affected notebook configuration triggers execution.
Root Cause
The root cause is missing HTML attribute encoding when concatenating user-controlled notebook template paths into the value attribute of an input element. Characters such as ", <, and > are not escaped, so an attacker can close the attribute and inject markup such as " onfocus="..." or additional attributes that trigger script execution.
Attack Vector
Exploitation requires an authenticated attacker with permission to configure notebook template paths. The attacker sets a template path containing an HTML-breaking payload, which SiYuan stores in notebook metadata. When any user with access to that notebook opens the configuration dialog, the malicious markup renders and the injected script executes in the victim's browser session. The payload can then issue same-origin fetch or XMLHttpRequest calls against SiYuan's API endpoints to exfiltrate content or manipulate settings. Refer to the GitHub Security Advisory and the VulnCheck Stored XSS Advisory for additional technical details.
Detection Methods for CVE-2026-87811
Indicators of Compromise
- Notebook template path values containing HTML metacharacters such as ", <, >, or onerror= / onfocus= substrings.
- Unexpected outbound requests from browser sessions immediately after opening SiYuan notebook configuration views.
- SiYuan API calls originating from user sessions that do not match normal interaction patterns for that user.
Detection Strategies
- Inspect SiYuan configuration files and notebook metadata for template path fields that contain quote characters or angle brackets.
- Enable and review web server access logs for POST requests to notebook configuration endpoints containing suspicious payload strings.
- Deploy a Content Security Policy in reporting mode to surface inline script execution or unexpected event handler triggers.
Monitoring Recommendations
- Monitor authenticated user activity for anomalous bulk reads or writes against SiYuan notebook APIs.
- Alert on modifications to notebook template path settings, especially by accounts that do not typically administer notebooks.
- Track SiYuan version strings across deployments to identify hosts still running releases prior to v3.8.2.
How to Mitigate CVE-2026-87811
Immediate Actions Required
- Upgrade all SiYuan installations to v3.8.2 or later.
- Audit existing notebook template path values and remove any entries containing HTML metacharacters or script fragments.
- Rotate SiYuan authentication credentials for any account whose session may have executed a malicious payload.
Patch Information
SiYuan v3.8.2 addresses the vulnerability by applying proper HTML attribute encoding to notebook template paths before rendering them in input value attributes. Refer to the GitHub Security Advisory GHSA-v6wf-r2gr-rrgf for the upstream fix and release notes.
Workarounds
- Restrict notebook configuration permissions to trusted administrators until patching is complete.
- Place SiYuan behind a reverse proxy that enforces a strict Content Security Policy disallowing inline event handlers.
- Avoid opening notebook configuration dialogs for notebooks sourced from untrusted users on unpatched instances.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
