VYPR
Vypr IntelligenceAI-generatedSep 9, 2026· 10 CVEs

Siyuan Note: Ten Vulnerabilities Including Code Execution and SQLi Disclosed Together

Ten vulnerabilities, including code execution and SQL injection, were disclosed for Siyuan Note affecting versions prior to v3.8.2.

Key findings

On September 9, 2026, a batch of ten vulnerabilities was disclosed for Siyuan Note, affecting versions prior to v3.8.2. The vulnerabilities, disclosed on September 8th and 9th, 2026, span several bug classes including path traversal, cross-site scripting (XSS), information disclosure, and SQL injection, with several rated as High severity. The most critical flaw, CVE-2026-86712, allows for code execution via a crafted clipboard entry.

Several vulnerabilities leverage cross-site scripting. CVE-2026-87814 and CVE-2026-87813 are stored XSS flaws in the search asset preview and search result list, respectively, where unescaped asset content and filenames can lead to JavaScript execution. CVE-2026-87811 is another stored XSS vulnerability in notebook templates, where crafted paths can break out of HTML attributes and execute JavaScript. CVE-2026-87812, a medium-severity stored XSS, affects Bazaar package cards by injecting malicious URLs into img src attributes.

Path traversal and SQL injection are also present. CVE-2026-87815 is a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint, allowing authenticated administrators to delete arbitrary files outside the workspace by manipulating the deckID parameter. CVE-2026-87807, a high-severity authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint (method=1), allows attackers to read the entire blocks table via UNION SELECT statements, bypassing access controls.

Information disclosure vulnerabilities include CVE-2026-87810, where unauthenticated readers can determine the existence of hidden content via unfiltered match counts in the fullTextSearchBlock endpoint. CVE-2026-87809, a medium-severity flaw, fails to filter publish-access for embedded blocks in preview and markdown export endpoints, potentially exposing private content. CVE-2026-87808 is noted as an incomplete fix for a previous SQL injection vulnerability, still allowing read-only access to certain data under specific conditions.

The most severe vulnerability, CVE-2026-86712, allows for code execution in the Node-enabled desktop renderer when a user pastes content from a crafted webpage into Siyuan. This bypasses sanitization of the text/siyuan clipboard MIME type.

All disclosed vulnerabilities are addressed in Siyuan Note version v3.8.2. Users are strongly advised to update to this version to mitigate the risks associated with these security flaws. The batch of vulnerabilities highlights the importance of input validation and proper output encoding across various API endpoints and user-facing features within Siyuan Note.

The disclosure of these vulnerabilities together underscores a significant security update for Siyuan Note users. The range of issues, from code execution to data exfiltration and arbitrary file deletion, necessitates prompt attention. Users should prioritize updating to version v3.8.2 to ensure their data and systems are protected against these threats.

The vulnerabilities disclosed include:

All affected versions are prior to v3.8.2. The fix is available in v3.8.2.

AI-written article. Grounded in 10 CVE records listed below.