CVE-2026-66396 | SiYuan before v3.7.2 fails to escape the title-img Individua… | CVSS 8.4 HIGH

Description

SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents.

Metadata

CVE ID: CVE-2026-66396
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-26 12:22 UTC
Published: 2026-07-27 15:43 UTC
Last updated: 2026-07-28 01:06 UTC
Primary CWE: CWE-79
Improper Neutralization of Input During Web Page Generation …
Vendor / Product: siyuan-note / siyuan
Sources: cve.org · NVD

Severity & Metrics

8.4 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
siyuan-note	siyuan	—	0 < 3.7.2, 3.7.2

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
8.4	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

References (2)

GitHub Security Advisory (GHSA-5rxg-wh59-mg34) https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5rxg-wh59-mg34
VulnCheck Advisory: SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL https://www.vulncheck.com/advisories/siyuan-before-stored-xss-to-rce-via-title-img-ial