Stored Cross-Site Scripting Vulnerability in SiYuan by SiYuan Note

CVE-2026-100645

What is CVE-2026-100645?

SiYuan versions 3.7.0 prior to 3.8.4 exhibit a stored cross-site scripting vulnerability, specifically within gallery and kanban database renderers. This flaw stems from the failure to escape field descriptions in aria-label attributes, allowing attackers to inject malicious JavaScript. In scenarios where the Electron desktop application operates with nodeIntegration enabled, this vulnerability enables the execution of arbitrary commands with user privileges, heightening the risk of unauthorized access and manipulation of system resources.

References