Executive brief
SiYuan is a popular note-taking and knowledge management application. A stored cross-site scripting vulnerability in notebook configuration settings allows attackers to craft malicious template paths that execute arbitrary JavaScript in authenticated users' browsers. An attacker with the ability to save configuration can trigger code execution when any user opens notebook settings, potentially compromising sensitive notes, enabling unauthorized API access, and manipulating application state.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in SiYuan versions before 3.8.2. The vulnerability exists in the notebook configuration interface (menus/onGetnotebookconf.ts), where docCreateTemplatePath and dailyNoteTemplatePath values are inserted into HTML input value attributes without proper HTML entity encoding or escaping. The vulnerable paths are persisted in the backend (kernel/conf/box.go) and accepted via the notebook API (kernel/api/notebook.go). An attacker can craft a malicious template path containing JavaScript event handlers (e.g., `x" autofocus onfocus="malicious_js" data-extra="`) that break out of the attribute context and execute arbitrary code when a victim opens the notebook configuration dialog. The attack requires authentication and user interaction (opening the notebook config), but achieves full impact within the authenticated origin, enabling same-origin API calls and application state manipulation. The vulnerability was patched in version 3.8.2 by implementing proper attribute encoding using escapeAttr and preferring DOM APIs over innerHTML for assignment.
Affected products
- SiYuan SiYuan before 3.8.2
Timeline
- 2026-08-26: disclosed: GitHub Security Advisory GHSA-v6wf-r2gr-rrgf published
- 2026-09-09: advisory: CVE-2026-87811 published on NVD
- 2026-09-09: patched: Version 3.8.2 released with fix