EUVD-2026-48241
GHSA-99f6-8pmj-83xw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS delivered remotely with no privileges but requiring the victim to view the database (UI:R); S:C because the nodeIntegration escape crosses from browser context to full OS command execution, giving high C/I/A.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced self-closing tags such as <img> are skipped by that check, a payload like <img src=x onerror=...> is stored unescaped and later inserted into the page via innerHTML, executing when the database is viewed. Because the desktop renderer runs with nodeIntegration enabled, the injected script can reach require and escalate to arbitrary command execution.
AnalysisAI
Stored cross-site scripting leading to remote code execution in SiYuan (self-hosted note-taking application) before v3.7.2 allows an attacker to run arbitrary OS commands when a victim views a database. A Template-column value in the Attribute View is rendered through Go's text/template without auto-escaping, and the EscapeHTML safeguard is bypassed by balanced self-closing tags like <img>, so a payload such as <img src=x onerror=...> is stored raw and later injected via innerHTML; because the Electron desktop renderer runs with nodeIntegration enabled, the script reaches require and escalates to command execution. No public exploit identified at time of analysis, and it is not listed in CISA KEV, though a detailed VulnCheck advisory and vendor GHSA describe the flaw.
Technical ContextAI
The vulnerability lives in SiYuan's Attribute View (its database/table feature) cell rendering path. Template columns are evaluated with Go's text/template package, which - unlike html/template - performs no contextual auto-escaping, placing the burden of sanitization on the application. SiYuan attempts to compensate by calling EscapeHTML only when a helper, HasUnclosedHtmlTag, returns true. That heuristic assumes dangerous markup manifests as an unclosed tag, but balanced void/self-closing elements such as <img src=x onerror=...> are structurally complete and slip past the check, so the malicious HTML is persisted unescaped and subsequently written to the DOM through innerHTML. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) failure, compounded by the Electron trust model: with nodeIntegration enabled the renderer has direct access to Node's require, converting a browser-context XSS into full host command execution.
RemediationAI
Upgrade to SiYuan v3.7.2 or later, which contains the fix referenced by vendor advisory GHSA-pw5c-qhf3-jhwh (https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pw5c-qhf3-jhwh) and commit 41f2861c87575ff5ac4b50a0520b1a4fe55b4a70. Because the fix corrects both the escaping heuristic and the rendering path, patching is the primary and recommended action. Until upgrading, reduce exposure by not opening or importing databases/notebooks from untrusted or shared sources and by avoiding Template columns populated with externally-supplied content, since these are the injection vectors; the trade-off is loss of collaboration/import convenience. Hardening the Electron shell by disabling nodeIntegration (or enabling contextIsolation) would downgrade a successful XSS from RCE to browser-context script execution, but this is generally only feasible via an official build change, not end-user configuration, and may break app functionality.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today