CVE-2026-87812 Overview
CVE-2026-87812 is a stored cross-site scripting (XSS) vulnerability in the SiYuan note-taking application before version 3.8.2. The flaw exists in Bazaar package cards, where the iconURL metadata field is inserted directly into HTML imgsrc attributes without escaping. Attackers can craft malicious URLs containing event handlers that execute JavaScript in the authenticated SiYuan origin when users view Bazaar listings. Successful exploitation lets attackers issue API requests and manipulate application state on behalf of the victim. The vulnerability is tracked under CWE-79.
Critical Impact
Attacker-controlled JavaScript executes in the authenticated SiYuan origin, enabling API abuse and manipulation of user data.
Affected Products
- SiYuan note-taking application versions prior to v3.8.2
- Bazaar package ecosystem (plugin, template, theme, widget, and icon listings)
- Any SiYuan instance where users browse or install Bazaar packages
Discovery Timeline
- 2026-09-09 - CVE-2026-87812 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87812
Vulnerability Analysis
SiYuan renders community package cards inside its Bazaar marketplace UI. Each package supplies metadata, including an iconURL field pointing to a preview image. Versions before v3.8.2 inject this value directly into the src attribute of an img element without HTML escaping or URL validation.
Because the rendered markup runs within the authenticated SiYuan origin, injected JavaScript inherits full session context. Attackers can invoke authenticated REST endpoints, read notebook contents, modify configuration, or pivot to further client-side attacks.
Root Cause
The root cause is missing output encoding on package metadata (see CWE-79). The Bazaar rendering path treats iconURL as trusted markup rather than untrusted text, allowing attribute-boundary breakout when the value contains quotes and event handlers such as onerror or onload.
Attack Vector
An attacker publishes a malicious package to a Bazaar source consumed by SiYuan, or convinces a maintainer to accept a package whose iconURL contains an XSS payload. When any authenticated user browses the Bazaar listing, the malicious img tag renders and its event handler fires. No privileges are required to publish, but the victim must open the affected view. Refer to the GitHub Security Advisory GHSA-rvcf-q4h8-w6c9 and the VulnCheck Stored XSS Advisory for additional detail.
// No verified exploit code is published for CVE-2026-87812.
// The vulnerability class involves unescaped iconURL metadata rendered
// inside an <img src="..."> attribute in Bazaar package cards.
Detection Methods for CVE-2026-87812
Indicators of Compromise
- Bazaar package manifests where the iconURL field contains quote characters, javascript: schemes, or inline event handlers such as onerror= and onload=.
- Browser console errors or Content Security Policy violations originating from the SiYuan Bazaar UI.
- Unexpected authenticated API calls to SiYuan endpoints originating from a user session that recently viewed Bazaar listings.
Detection Strategies
- Inspect installed and cataloged Bazaar package metadata for iconURL values that do not match a plain image URL pattern.
- Deploy a strict Content Security Policy on the SiYuan origin and alert on script-src and img-src violations.
- Review web proxy or endpoint telemetry for outbound requests initiated by the SiYuan renderer that reference attacker-controlled domains.
Monitoring Recommendations
- Track SiYuan version inventory and flag any host running a build older than v3.8.2.
- Monitor Bazaar community sources for new or updated packages and validate their metadata before allowing installation.
- Enable audit logging on SiYuan API endpoints to correlate suspicious actions with user browsing activity in the Bazaar view.
How to Mitigate CVE-2026-87812
Immediate Actions Required
- Upgrade all SiYuan installations to version v3.8.2 or later.
- Restrict Bazaar package sources to trusted maintainers until the upgrade is complete.
- Instruct users to avoid browsing Bazaar listings on unpatched instances.
Patch Information
SiYuan version v3.8.2 remediates CVE-2026-87812 by properly escaping the iconURL metadata before it is rendered inside HTML attributes. Details are available in the GitHub Security Advisory GHSA-rvcf-q4h8-w6c9 and the VulnCheck advisory.
Workarounds
- Disable the Bazaar marketplace UI on unpatched SiYuan instances where possible.
- Enforce a Content Security Policy that blocks inline scripts and unexpected image origins on the SiYuan web interface.
- Proxy Bazaar package feeds through a validation service that rejects iconURL values containing quote characters, event handlers, or non-image schemes.
# Example: verify installed SiYuan version and upgrade if below v3.8.2
siyuan --version
# Upgrade via the official installer or container image tagged v3.8.2 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
