CVE-2026-65605
Received Received - Intake

Stored XSS in SiYuan Database Cell Rendering

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced self-closing tags such as <img> are skipped by that check, a payload like <img src=x onerror=...> is stored unescaped and later inserted into the page via innerHTML, executing when the database is viewed. Because the desktop renderer runs with nodeIntegration enabled, the injected script can reach require and escalate to arbitrary command execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65605
EUVD
EUVD-2026-48241

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan before v3.7.2 has a stored cross-site scripting (XSS) vulnerability in Attribute View database cell rendering. Template column values are rendered as HTML without auto-escaping. The EscapeHTML function only activates for unclosed tags, but balanced self-closing tags like <img> bypass this check. A payload such as <img src=x onerror=...> is stored unescaped and later inserted via innerHTML, executing when the database is viewed. Since the desktop renderer runs with nodeIntegration enabled, the script can access require and escalate to arbitrary command execution.

The flaw affects versions up to but not including 3.7.2 and has a CVSS score of 9.4 (Critical).

Detection Guidance

To detect this vulnerability, check the installed version of SiYuan. If it is below 3.7.2, the system is vulnerable. Commands to check version: On Linux/macOS, run `siyuan --version` or check the application about section. On Windows, check the installed program list or run `wmic product get name,version | findstr siyuan`.

Impact Analysis

An attacker could inject malicious scripts into a SiYuan database via a Template or URL column. When the database is viewed, the script executes, potentially allowing the attacker to steal data, manipulate content, or execute arbitrary commands on the victim's system due to nodeIntegration being enabled.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or exfiltration, violating GDPR's integrity and confidentiality principles and HIPAA's safeguards for protected health information. The potential for arbitrary command execution exacerbates compliance risks by enabling data breaches or system compromise.

Mitigation Strategies

Immediately upgrade SiYuan to version 3.7.2 or later. Disable nodeIntegration in the desktop app if possible. Avoid opening untrusted databases or documents. Monitor for suspicious activity in logs or network traffic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65605. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart