CVE-2026-87813

8.4 highEPSS 0.4%

High (8.4). EPSS 0.4% chance of exploitation in the next 30 days.

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's browser when searching assets, enabling same-origin API requests and application state manipulation.

Severity

CVSS 4.0

8.4 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.3 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-09-09
Modified: 2026-09-09
Record from: the NVD, synced 2026-10-19

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qcw6-qm34-28h8
https://www.vulncheck.com/advisories/siyuan-before-3.8.2-stored-xss-via-unescaped-asset-filenames
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qcw6-qm34-28h8

Check your stack JSON