CVE-2026-66396
SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL
CVSS Score
8.4
EPSS Score
0.0%
EPSS Percentile
0th
SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents.
| CWE | CWE-79 |
| Vendor | siyuan-note |
| Product | siyuan |
| Published | Jul 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for siyuan-note siyuan
Be the first to know when new high vulnerabilities affecting siyuan-note siyuan are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
siyuan-note / siyuan
0 < 3.7.2
References
Credits
🔍 hypnguyen1209