Stored XSS to RCE via incomplete HTML escaping in SiYuan Attribute View (CVE-2026-65605)

SiYuan's Attribute View (database) template column renders cell values as HTML using text/template without auto-escaping, applying EscapeHTML only when HasUnclosedHtmlTag returns true. Because that check treats self-closing tags such as <img> as balanced and skips them, a payload like <img src=x onerror=...> is stored unescaped and injected into the page via innerHTML on view. On the desktop renderer, which runs with nodeIntegration enabled, the injected script can access require and escalate to arbitrary command execution. Affected versions: - <= 3.7.1 We recommend updating to: v3.7.2. CVSS 9.4 · our assessment: act_now Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pw5c-qhf3-jhwh Details: https://vuln.today/cve/CVE-2026-65605