All vulnerabilities
CVE-2026-100645GHSA-556j-q8c8-qqg3

SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban

siyuan-note siyuan
Open in ThreatlineRecord JSON
CVSS
8.6High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 2 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.8.4Fixed versionCVE List
Published26 Sep 2026Updated 8 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, attackers can inject JavaScript that calls Node.js child_process APIs to execute arbitrary commands with user privileges.

Text from CVE List

Affected versions 2

  • siyuanaffected: 3.7.0 before 3.8.4CVE List
  • siyuanunaffected: 3.8.4CVE List

References 2