Executive brief
SiYuan is a note-taking and knowledge management application. The search asset preview feature fails to sanitize crafted text files before displaying them, allowing an attacker with workspace access to execute malicious JavaScript in the application. This can lead to unauthorized API requests, workspace data manipulation, and account compromise.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the asset preview functionality. The vulnerable code at app/src/search/assets.ts:230-233 uses innerHTML to insert content returned by /api/search/getAssetContent without HTML escaping. The backend kernel/model/asset_content.go reads crafted text assets and returns their raw content without sanitization. An authenticated attacker who can place malicious text files in a shared, synchronized, or imported workspace can trigger JavaScript execution when victims preview those assets. The payload executes in the SiYuan origin, enabling authenticated API calls and workspace manipulation. Patches are available in v3.8.2 and later, which use textContent or HTML escaping instead of innerHTML with raw content.
Affected products
- SiYuan SiYuan before 3.8.2
Timeline
- 2026-08-26: disclosed: GitHub Security Advisory GHSA-64gp-333q-mq6j published
- 2026-09-09: advisory: CVE-2026-87814 published on NVD
- 2026-09-09: patched: v3.8.2 released with fix