CVE-2026-66396
Received Received - Intake

SiYuan Stored XSS via Unescaped Gallery Cover Image Attributes

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: VulnCheck

Description
SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-66396
EUVD
EUVD-2026-49329

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
siyuan siyuan to 3.7.2 (exc)
siyuan siyuan 3.7.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan before v3.7.2 has a stored cross-site scripting (XSS) vulnerability due to improper escaping of the title-img attribute in Gallery and Kanban cover images. Attackers with editor permissions can inject malicious code via unescaped style attributes, which executes arbitrary JavaScript in the Electron renderer with full Node.js access when victims open affected documents.

Detection Guidance

To detect this vulnerability, inspect SiYuan documents for malicious title-img IAL values in Gallery or Kanban cover images. Check for style attributes containing onload handlers or JavaScript execution payloads. Review SiYuan version to confirm it is below 3.7.2.

Commands: Check SiYuan version via application settings or about dialog. Inspect document source for title-img attributes with suspicious payloads like background:red;" onload="require('child_process').exec('id')

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system with full Node.js privileges when you open a maliciously crafted SiYuan document. The attack can lead to remote code execution (RCE) on your operating system, potentially compromising your data and system integrity.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or exfiltration, violating GDPR's confidentiality and integrity requirements and HIPAA's safeguards for protected health information. Organizations using affected SiYuan versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade SiYuan to version 3.7.2 or later immediately. Remove editor permissions from untrusted users until patched. Scan documents for malicious title-img attributes and remove any suspicious payloads.

Disable nodeIntegration, contextIsolation, and webSecurity in SiYuan's Electron configuration if possible. Monitor for unusual activity or unauthorized command execution on systems running SiYuan.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66396. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart