https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-08T13:51:06.287383+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-87813 CVE-2026-87813 — SiYuan before v3.8.2 Stored XSS via unescaped asset filenames 2026-10-08T13:51:06.574078+00:00

Affected: siyuan-note siyuan

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's browser when searching assets, enabling same-origin API requests and application state manipulation.