CVE-2026-100643

HIGH 8.0

SiYuan before v3.8.4 Stored XSS via Attribute View textarea

CVSS Score

8.0

EPSS Score

0.0%

EPSS Percentile

0th

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute stored JavaScript when other users open affected database menus, and in the Electron desktop app with nodeIntegration enabled, this leads to command execution with SiYuan process privileges.

CWE	CWE-79
Vendor	siyuan-note
Product	siyuan
Published	Sep 26, 2026

Stay Ahead of the Next One

Get instant alerts for siyuan-note siyuan

Be the first to know when new high vulnerabilities affecting siyuan-note siyuan are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

siyuan-note / siyuan

2.10.8 < 3.8.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h3p6-c22r-fx2j vulncheck.com: https://www.vulncheck.com/advisories/siyuan-before-3.8.4-stored-xss-via-attribute-view-textarea

Credits

Smavl