PT-2026-95720 · Siyuan · Siyuan
CVSS v3.1
8.8
عالية
| المتجه | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
SiYuan versions prior to 3.8.5
Description
The software renders notebook names as raw HTML in the Daily Note picker dialog without proper escaping. This leads to stored cross-site scripting (XSS) within the Electron renderer. An attacker can create a notebook with a name containing HTML payloads that execute JavaScript with Node.js access when the picker is opened, potentially allowing the execution of operating system commands.
Recommendations
Update SiYuan to version 3.8.5 or later.
استغلال
إصلاح
XSS
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Siyuan