CVE-2026-87814 is a stored cross-site scripting vulnerability affecting SiYuan note-taking software before version 3.8.2. The flaw exists in the search asset preview feature, where indexed asset content is inserted into the DOM using innerHTML without proper escaping or neutralization. This allows attackers who can place malicious text assets in a workspace to execute arbitrary JavaScript code when other users preview these assets. The executed script can perform authenticated API requests and manipulate the victim's workspace, potentially compromising user data and session integrity.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the SiYuan application origin. This can lead to unauthorized authenticated API requests and manipulation of the victim's workspace, potentially resulting in data compromise or unauthorized actions within the application. The vulnerability requires the attacker to have the ability to add crafted text assets to a workspace and the victim to preview those assets.

A fix is available in SiYuan version 3.8.2. Users and administrators should upgrade to version 3.8.2 or later to remediate this vulnerability. No additional vendor advisory or patch details are provided, so checking the official SiYuan release notes or security advisories for confirmation and further guidance is recommended.