Stored Cross-Site Scripting in SiYuan Product by SiYuan Note
CVE-2026-65605

9.4CRITICAL

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
23 July 2026

What is CVE-2026-65605?

Before version 3.7.2, SiYuan contains a vulnerability that allows for stored cross-site scripting in the Attribute View feature. Due to improper handling of HTML rendering within the template column, an attacker can store malicious payloads that include scripts, such as . When a user later accesses the database, the malicious script executes via innerHTML, potentially enabling the attacker to escalate privileges and gain arbitrary code execution. This vulnerability poses significant risks, particularly because the desktop renderer has node integration enabled.

Affected Version(s)

siyuan 0 < 3.7.2

siyuan 3.7.2

References

https://github.com/siyuan-note/siyuan/security/advisories...
vendor-advisory
https://github.com/siyuan-note/siyuan/commit/41f2861c8757...
patch
https://www.vulncheck.com/advisories/siyuan-before-stored...
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hyuunnn
.