CVE-2026-100645
Deferred Deferred - Pending Action

Stored XSS in SiYuan Desktop App with Node Integration

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, attackers can inject JavaScript that calls Node.js child_process APIs to execute arbitrary commands with user privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100645
EUVD
EUVD-2026-87739

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
siyuan siyuan From 3.7.0 (inc) to 3.8.4 (exc)
siyuan siyuan to 3.8.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in SiYuan versions 3.7.0 to 3.8.3. It occurs in the gallery and kanban database renderers where unsanitized field descriptions are inserted into the DOM without proper escaping. Attackers can inject malicious JavaScript payloads that execute when a card is rendered.

Detection Guidance

Check SiYuan versions 3.7.0 to 3.8.3 for the vulnerability. Inspect database field descriptions in gallery or kanban renderers for unsanitized HTML or JavaScript payloads. Look for payloads like "><img src=x onerror=alert(1337)> in aria-label attributes.

Commands: grep -r "aria-label" /path/to/siyuan/data | grep -i "onerror\|javascript\|src=x"

Impact Analysis

In the Electron desktop app with nodeIntegration enabled, the injected JavaScript can leverage Node.js child_process APIs to execute arbitrary commands with the user's privileges. This could allow attackers to take control of the user's system or steal sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA compliance requirements for data protection and confidentiality. The potential for arbitrary command execution may also result in data breaches or unauthorized system access.

Mitigation Strategies

Upgrade SiYuan to version 3.8.4 or later immediately. Disable nodeIntegration in the Electron app configuration. Enable contextIsolation and remove @electron/remote if used. Review and sanitize all database field descriptions to prevent XSS payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100645. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart