CVE-2026-100643
Deferred Deferred - Pending Action

SiYuan Stored XSS in Attribute View Textarea Elements

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute stored JavaScript when other users open affected database menus, and in the Electron desktop app with nodeIntegration enabled, this leads to command execution with SiYuan process privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100643
EUVD
EUVD-2026-87737

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
siyuan siyuan to 3.8.4 (exc)
siyuan siyuan From 2.10.8 (inc) to 3.8.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in SiYuan versions before v3.8.4. It occurs because four Attribute View textarea elements fail to properly escape user-controlled data in field descriptions, template sources, select option descriptions, and footer calculation templates. Attackers with authentication can inject JavaScript payloads that execute when other users interact with these elements. In the Electron app with nodeIntegration enabled, this leads to full command execution with SiYuan process privileges.

Detection Guidance

Check SiYuan versions installed on your system. Versions before v3.8.4 are vulnerable. Inspect Attribute View elements for unexpected JavaScript payloads in field descriptions, template sources, select option descriptions, or footer calculation templates.

Impact Analysis

If you use SiYuan versions before v3.8.4, an authenticated attacker could inject malicious scripts into your notes or templates. When you or other users access these elements, the scripts execute, potentially stealing data, modifying content, or taking control of your SiYuan application. In the Electron desktop app with nodeIntegration enabled, this could allow full system compromise with the privileges of the SiYuan process.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or exfiltration, violating GDPR's integrity and confidentiality principles and HIPAA's security requirements for protected health information. Organizations using affected SiYuan versions may face compliance violations, data breaches, and potential regulatory penalties due to insufficient protection against stored XSS attacks.

Mitigation Strategies

Upgrade SiYuan to v3.8.4 or later. If upgrading is not possible, apply input validation and output encoding to sanitize user-controlled data in the four affected textarea fields. Disable nodeIntegration in the Electron app if enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100643. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart