Executive brief
SiYuan is a popular note-taking and knowledge management application. An authenticated user can craft malicious asset filenames that execute JavaScript in the browser when other users search for assets, potentially allowing the attacker to steal data, manipulate notes, or perform unauthorized actions on behalf of victims without their knowledge.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Search Assets feature of SiYuan versions before 3.8.2. The vulnerability exists in app/src/search/assets.ts where asset filenames are interpolated into HTML result-list templates without HTML escaping, while file content is properly escaped by the backend. An authenticated attacker can create or upload an asset with a malicious filename containing JavaScript event handlers (e.g., <img src=x onerror="malicious code">). When another authenticated user searches assets, the unescaped filename executes arbitrary JavaScript in the victim's browser within the SiYuan origin, enabling same-origin API requests and application state manipulation. The vulnerability requires authentication and user interaction (searching assets) to trigger. The fix is available in version 3.8.2, which properly escapes asset filenames using escapeHtml().
Affected products
- SiYuan SiYuan before 3.8.2
Timeline
- 2026-08-26: advisory: GHSA-qcw-qm34-28h8 published
- 2026-09-09: disclosed: CVE-2026-87813 publicly disclosed