CVE-2026-87811

Deferred Deferred - Pending Action

SiYuan Persistent XSS via Unencoded Notebook Template Paths

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: VulnCheck

Description

SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft malicious template paths that break out of the attribute context and execute JavaScript when a victim opens notebook configuration, enabling same-origin API requests and application state manipulation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87811

EUVD

EUVD-2026-74837

Affected Vendors & Products

Vendor	Product	Version / Range
siyuan	siyuan	to 3.8.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-87811 is a stored cross-site scripting (XSS) vulnerability in SiYuan note-taking app versions up to 3.8.1. It occurs when unescaped template paths in notebook configuration are inserted into HTML value attributes without proper encoding. Attackers can craft malicious paths containing JavaScript payloads that execute when a victim views notebook settings. This allows same-origin API requests and application state manipulation.

Detection Guidance

To detect this vulnerability, inspect SiYuan application files for template path handling in notebook configuration. Check files like onGetnotebookconf.ts and box.go for improper encoding. Look for HTML input value attributes that may contain unescaped template paths. Review server logs for unusual JavaScript execution in notebook configuration pages.

Impact Analysis

An attacker could steal sensitive data like notes or credentials via same-origin requests. They might manipulate application state to alter or delete content. The attack requires minimal privileges and is triggered when a victim simply opens the notebook configuration page.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity/confidentiality requirements and HIPAA's safeguards for protected health information. Organizations using vulnerable SiYuan versions may face compliance violations and potential fines.

Mitigation Strategies

Immediately upgrade SiYuan to version 3.8.2 or later. If upgrading is not possible, apply input encoding to template paths using escapeAttr or DOM APIs for value assignment. Add validation to block template paths containing special characters or event attributes. Restrict access to notebook configuration pages until patched.

Hi! I’m here to help you understand CVE-2026-87811. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70