All vulnerabilities
CVE-2026-100643GHSA-h3p6-c22r-fx2j

SiYuan before v3.8.4 Stored XSS via Attribute View textarea

siyuan-note siyuan
Open in ThreatlineRecord JSON
CVSS
8.5High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 28 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.42%Chance of exploitation activity in the next 30 days, higher than 35% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.8.4Fixed versionCVE List
Published26 Sep 2026Updated 28 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute stored JavaScript when other users open affected database menus, and in the Electron desktop app with nodeIntegration enabled, this leads to command execution with SiYuan process privileges.

Text from CVE List

Affected versions 2

  • siyuanaffected: 2.10.8 before 3.8.4CVE List
  • siyuanunaffected: 3.8.4CVE List

References 2