Is there a patch available for CVE-2026-66394?

Yes, a patch is available for CVE-2026-66394. Update the affected software to the latest version immediately.

SiYuan CVE-2026-66394

Q: What is the CVSS score of CVE-2026-66394?

CVE-2026-66394 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-49327 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-07-27 disclosure@vulncheck.com

GHSA-5p6m-3744-5c8g

XSS

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 27, 2026 - 17:02 EUVD

Analysis Generated

Jul 27, 2026 - 16:31 vuln.today

CVE Published

Jul 27, 2026 - 16:18 cve.org

CRITICAL 9.3

DescriptionCVE.org

SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML parser treats as raw text but browsers interpret as executable SVG content when served as image/svg+xml, enabling script execution in the application origin.

AnalysisAI

Stored and reflected cross-site scripting (XSS) in SiYuan versions prior to 3.7.3 allows authenticated attackers to execute arbitrary JavaScript in the application origin by embedding script payloads in SVG elements that evade the HTML