CVE-2026-87813 is a stored cross-site scripting vulnerability affecting SiYuan note-taking software versions before 3.8.2. The flaw arises from improper neutralization of input during web page generation, specifically in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the context of the victim's browser upon searching assets. This can lead to unauthorized same-origin API requests and manipulation of the application's state.

An attacker with authenticated access can exploit this vulnerability to execute arbitrary JavaScript in the victim's browser when they perform asset searches. This can result in unauthorized actions within the application context, including API requests and state changes, potentially compromising user data or application integrity. The vulnerability has a high severity rating with a CVSS 4.0 score of 8.4.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to SiYuan version 3.8.2 or later once available. Until then, restrict asset filename inputs to trusted users and avoid searching assets with untrusted filenames to reduce exposure.