CVE-2026-87811: siyuan stored XSS — HIGH

CISO Take

SiYuan, an open-source note-taking and knowledge-base tool, fails to properly encode persisted notebook template paths before inserting them into HTML attribute values, letting an attacker-crafted path break out of the attribute context and execute arbitrary JavaScript when a victim opens notebook configuration. The CVSS 7.3 score reflects high confidentiality and integrity impact via same-origin API abuse and application state manipulation, but exploitation requires the victim to actively open the affected configuration screen, and there is no evidence of active exploitation: it is not in CISA KEV, no EPSS score is published, and no public exploit code or Nuclei template exists yet. For organizations using SiYuan as a personal or team knowledge base — including any that feed notes into downstream AI/RAG workflows — the realistic risk is a stored XSS delivered via a shared or synced notebook rather than a mass-exploited web-facing bug. Upgrade to SiYuan v3.8.2 or later, audit any shared/imported notebooks for suspicious template path values, and treat SiYuan instances as sensitive endpoints given their access to locally stored notes and API tokens.

Sources: NVD GitHub Advisory VulnCheck CISA KEV ATLAS

What is the risk?

Moderate-to-high risk in targeted scenarios, low risk of mass exploitation. The vulnerability requires low attack complexity and only low privileges to plant the malicious payload (AV:N/AC:L/PR:L), but requires user interaction (UI:R) — a victim must open notebook configuration for the payload to fire. No confirmed public exploit, no Nuclei scanner coverage, no CISA KEV listing, and no EPSS data suggest this is not being opportunistically exploited at scale today. The realistic threat model is a targeted stored-XSS attack against a specific SiYuan user or team (e.g., via a shared/synced notebook containing a poisoned template path), which given C:H/I:H impact could lead to full application state compromise and API-driven data exfiltration from that instance.

How does the attack unfold?

Payload staging

Attacker crafts a notebook template path containing characters that break out of the HTML attribute context and persists it via a shared, imported, or synced notebook.

Victim interaction

Victim opens notebook configuration in their SiYuan instance, causing the unsanitized template path to be rendered into the page.

AML.T0011

Script execution

The injected JavaScript executes in the victim's authenticated session, breaking out of the attribute context.

Impact

The script issues same-origin API requests to read or modify notebook data and manipulate application state within the victim's session.

Payload staging

Attacker crafts a notebook template path containing characters that break out of the HTML attribute context and persists it via a shared, imported, or synced notebook.

Victim interaction

Victim opens notebook configuration in their SiYuan instance, causing the unsanitized template path to be rendered into the page.

AML.T0011

Script execution

The injected JavaScript executes in the victim's authenticated session, breaking out of the attribute context.

Impact

The script issues same-origin API requests to read or modify notebook data and manipulate application state within the victim's session.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
siyuan	—	—	No patch

Do you use siyuan? You're affected.

How severe is it?

CVSS 3.1

7.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 11% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade all SiYuan deployments to v3.8.2 or later, where the advisory indicates the attribute-encoding flaw is fixed. Until patched, avoid opening notebook configuration screens for notebooks imported or synced from untrusted or external sources, and review existing notebook template path values for anomalous characters (quotes, angle brackets, javascript: or event-handler strings) that could indicate a planted payload. Restrict notebook sharing/sync to trusted parties, and monitor SiYuan's local API access logs (if enabled) for unexpected same-origin requests following configuration screen access. Treat any SiYuan instance handling sensitive notes as requiring the same patch hygiene as a browser-facing admin panel.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Data Leakage Plugin AML.T0011 - User Execution

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MANAGE-4.1 - Risk treatment and monitoring of third-party/component risks

Frequently Asked Questions

What is CVE-2026-87811?

SiYuan, an open-source note-taking and knowledge-base tool, fails to properly encode persisted notebook template paths before inserting them into HTML attribute values, letting an attacker-crafted path break out of the attribute context and execute arbitrary JavaScript when a victim opens notebook configuration. The CVSS 7.3 score reflects high confidentiality and integrity impact via same-origin API abuse and application state manipulation, but exploitation requires the victim to actively open the affected configuration screen, and there is no evidence of active exploitation: it is not in CISA KEV, no EPSS score is published, and no public exploit code or Nuclei template exists yet. For organizations using SiYuan as a personal or team knowledge base — including any that feed notes into downstream AI/RAG workflows — the realistic risk is a stored XSS delivered via a shared or synced notebook rather than a mass-exploited web-facing bug. Upgrade to SiYuan v3.8.2 or later, audit any shared/imported notebooks for suspicious template path values, and treat SiYuan instances as sensitive endpoints given their access to locally stored notes and API tokens.

Is CVE-2026-87811 actively exploited?

No confirmed active exploitation of CVE-2026-87811 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-87811?

Upgrade all SiYuan deployments to v3.8.2 or later, where the advisory indicates the attribute-encoding flaw is fixed. Until patched, avoid opening notebook configuration screens for notebooks imported or synced from untrusted or external sources, and review existing notebook template path values for anomalous characters (quotes, angle brackets, `javascript:` or event-handler strings) that could indicate a planted payload. Restrict notebook sharing/sync to trusted parties, and monitor SiYuan's local API access logs (if enabled) for unexpected same-origin requests following configuration screen access. Treat any SiYuan instance handling sensitive notes as requiring the same patch hygiene as a browser-facing admin panel.

What systems are affected by CVE-2026-87811?

This vulnerability affects the following AI/ML architecture patterns: AI-assisted knowledge management / note-taking tools, browser-based admin/configuration interfaces, local-first AI tool deployments with sync/sharing features.

What is the CVSS score for CVE-2026-87811?

CVE-2026-87811 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

AI-assisted knowledge management / note-taking toolsbrowser-based admin/configuration interfaceslocal-first AI tool deployments with sync/sharing features

MITRE ATLAS Techniques

AML.T0011 User Execution

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE-4.1

What are the technical details?

Original Advisory

SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft malicious template paths that break out of the attribute context and execute JavaScript when a victim opens notebook configuration, enabling same-origin API requests and application state manipulation.

Exploitation Scenario

An attacker shares or contributes a SiYuan notebook (e.g., via a public template repository, a collaborative workspace, or a compromised sync source) containing a template path crafted to break out of the HTML `value` attribute and inject a `<script>` payload. The victim, unaware of the tampering, opens notebook configuration in their own SiYuan instance, causing the browser to render the unsanitized path and execute the attacker's JavaScript in the victim's authenticated session. The script then issues same-origin API requests to read notebook contents, exfiltrate configuration/API tokens, or silently modify application settings — persisting attacker control until the victim notices or the instance is patched.

Weaknesses (CWE)

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.