Stored XSS to OS RCE via unescaped style attribute in SiYuan (CVE-2026-66396)

SiYuan fails to escape the `title-img` Individual Attribute List value before interpolating it into the `style` attribute of cover images rendered in the Attribute-View Gallery and Kanban features. An attacker with editor permissions can inject an `onload` event handler that executes arbitrary code in the Electron renderer process with full Node.js access. In deployments with the Publish/MCP feature enabled, an unauthenticated network attacker can plant the malicious attribute without valid credentials. Affected versions: - 3.7.1 We recommend updating to: v3.7.2. CVSS 9.3 · our assessment: act_now Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5rxg-wh59-mg34 Details: https://vuln.today/cve/CVE-2026-66396