The reported issue is a stored cross‑site scripting flaw located in the asset search results list where filenames are displayed without escaping. Because the filenames are controlled by the attacker through crafted uploads, the malicious markup runs in the victim’s browser whenever that user searches for assets. This allows the attacker to execute arbitrary JavaScript in the victim’s session, enabling same‑origin API calls, session hijacking or manipulation of application state.

Siyuan Note’s Siyuan application is impacted, specifically all releases prior to 3.8.2, including 3.8.1 and earlier. The vulnerability is present across all supported platforms because the asset search interface is a core feature of both the desktop and web editions.

The CVSS score of 8.4 indicates high severity. Exposure requires an authenticated session, so an attacker must first obtain legitimate credentials or trick a user into authenticating. Once authenticated, the attacker can create a filename containing malicious markup, trigger a search, and have the script executed in the victim’s browser. The EPSS score is not available, and the issue is not listed in the CISA KEV database, suggesting no widely documented exploitation has yet been observed. Nevertheless, the stored XSS could be used to hijack sessions, read cookies, and perform same‑origin API requests, so the risk is significant for any environment relying on the affected versions.