CVE-2026-75916
Received Received - Intake

Stored XSS in SiYuan Note-Taking Application

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can set these metadata fields on a block can inject a self-firing payload (e.g. <img src=x onerror=...>) that executes automatically when a victim types '((' followed by a search term that surfaces the crafted block. Because SiYuan's Electron windows run with nodeIntegration enabled, contextIsolation disabled, and no CSP, the injected script gains require('child_process') access, allowing the XSS to escalate to arbitrary OS command execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-75916
EUVD
EUVD-2026-62441

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
si_yuan si_yuan to 3.7.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan through 3.7.3 has a cross-site scripting (XSS) vulnerability in the block-reference autocomplete popup. When a user types '((', the application concatenates block metadata fields (name, alias, memo) into HTML without proper escaping. An attacker can inject malicious JavaScript payloads into these fields, which execute automatically when the crafted block appears in search results.

Detection Guidance

This vulnerability is specific to the SiYuan application and requires manual inspection of the application's code or behavior. Check if SiYuan is running with nodeIntegration enabled, contextIsolation disabled, and no CSP. Look for suspicious block metadata (name, alias, memo) containing HTML/JS payloads. No direct network commands can detect this.

Impact Analysis

This vulnerability allows an attacker to execute arbitrary JavaScript in your SiYuan application. Due to Electron's nodeIntegration and lack of Content Security Policy (CSP), the injected script can gain access to the 'child_process' module, enabling full OS command execution. This means an attacker could take control of your system or steal sensitive data.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized code execution and potential data exfiltration. GDPR requires protection against unauthorized access to personal data, while HIPAA mandates safeguards for protected health information. The lack of CSP and nodeIntegration further weakens security controls required by these regulations.

Mitigation Strategies

Upgrade SiYuan to a patched version if available. Disable nodeIntegration and enable contextIsolation in SiYuan's Electron configuration. Implement a strict CSP to block inline scripts. Review and sanitize block metadata fields to prevent XSS payloads. Monitor for unusual OS command execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75916. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart