CVE-2026-87814: SiYuan XSS Vulnerability in Search Feature

CVE-2026-87814 Overview

CVE-2026-87814 is a stored cross-site scripting (XSS) vulnerability in SiYuan, an open-source personal knowledge management application. Versions prior to v3.8.2 fail to escape indexed asset content before inserting it into the Document Object Model (DOM) using innerHTML in the search asset preview feature. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYuan origin when victims preview those assets. Successful exploitation enables authenticated API requests and arbitrary workspace manipulation on behalf of the victim.

Critical Impact
Attackers with low-privilege workspace access can execute arbitrary JavaScript in the victim's SiYuan session, hijack authenticated API calls, and modify workspace content.

Affected Products

SiYuan versions prior to v3.8.2
SiYuan search asset preview feature
Workspaces where untrusted users can upload or place text assets

Discovery Timeline

2026-09-09 - CVE-2026-87814 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87814

Vulnerability Analysis

The flaw is a stored cross-site scripting weakness classified under [CWE-79]. SiYuan indexes asset files placed in a workspace and renders previews of matching assets when a user issues a search query. The preview rendering path passes indexed asset content directly to innerHTML without HTML escaping or sanitization.

Because the content is inserted as live markup, any HTML or JavaScript embedded in a crafted text asset executes in the SiYuan browser origin. The attacker only needs the ability to place a text asset in the workspace, and the payload triggers when a victim previews the asset from search results.

Execution occurs in the authenticated context of the previewing user. The attacker can therefore invoke SiYuan's internal APIs, read or modify notes, exfiltrate workspace data, and alter application state.

Root Cause

The root cause is unsafe DOM sink usage. The search asset preview handler concatenates indexed asset content into an innerHTML assignment rather than using a safe text sink such as textContent or a sanitizer such as DOMPurify. Indexed asset content is treated as trusted data even though it originates from user-controlled files.

Attack Vector

Exploitation requires an attacker to place a crafted text asset containing HTML or <script>-equivalent payloads into a workspace accessible to the victim. When the victim runs a search that surfaces the asset and previews it, the payload executes in the SiYuan origin. User interaction is required, and the attacker needs low-level authenticated access to the target workspace.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-64gp-333q-mq6j and the VulnCheck Advisory for Siyuan XSS for additional technical detail.

Detection Methods for CVE-2026-87814

Indicators of Compromise

Text assets in the SiYuan workspace containing HTML tags, <script> elements, event handler attributes such as onerror or onload, or javascript: URIs.
Unexpected outbound requests from browsers hosting the SiYuan application to attacker-controlled domains shortly after search preview activity.
Unauthorized modifications to notes, blocks, or workspace configuration following asset preview events.

Detection Strategies

Scan workspace asset directories for text files containing HTML sinks, script tags, or inline event handlers that should not appear in legitimate note content.
Review browser console and network telemetry from clients running SiYuan for script execution or API calls that do not correlate with user-driven navigation.
Correlate authenticated SiYuan API activity with the local user session to identify calls issued from unexpected DOM contexts.

Monitoring Recommendations

Log and alert on new or modified asset files in shared SiYuan workspaces, particularly text assets received from external contributors.
Monitor SiYuan application logs for repeated search and preview activity followed by burst API traffic that suggests automated abuse.
Track SiYuan version inventory across endpoints and flag any host still running a release earlier than v3.8.2.

How to Mitigate CVE-2026-87814

Immediate Actions Required

Upgrade all SiYuan installations to v3.8.2 or later without delay.
Audit existing workspace asset directories for suspicious text files and remove any content containing HTML or script payloads.
Restrict who can add assets to shared workspaces, and treat asset uploads from untrusted contributors as high-risk input.

Patch Information

The SiYuan maintainers addressed the issue in version v3.8.2 by escaping indexed asset content before rendering it in the search preview. Details are published in GitHub Security Advisory GHSA-64gp-333q-mq6j.

Workarounds

Avoid using the search asset preview feature until the upgrade to v3.8.2 is complete.
Limit workspace membership to trusted users and disable asset uploads from untrusted sources.
Isolate the SiYuan browser session from sensitive credentials by running it in a dedicated browser profile until patched.

bash

# Verify the installed SiYuan version and confirm it is v3.8.2 or later
siyuan --version