Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2026-100645

SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, attackers can inject JavaScript that calls Node.js child_process APIs to execute arbitrary commands with user privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

siyuan-note siyuan

Default version status: unaffected

  • 3.7.0 to < 3.8.4affected
  • 3.8.4unaffected
pkg:golang/github.com/siyuan-note/siyuan/kernel

References