Hyuunnn

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.7.2 **Description** A stored cross-site scripting issue exists in the Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping. The `EscapeHTML` function is only triggered when `HasUnclosedHtmlTag()` returns true. Since balanced self-closing tags, such as `<img>`, bypass this check, malicious payloads can be stored unescaped and later inserted into the page via `innerHTML`. In the desktop renderer, where `nodeIntegration` is enabled, the injected script can access the `require` function, potentially leading to arbitrary command execution. **Recommendations** Update SiYuan to version 3.7.2 or later.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.7.2 **Description** A cross-site scripting issue exists in the `siyuan://` protocol handler. When a link using the format `siyuan://plugins/<name>` references a plugin that is not installed, the application opens a custom tab and inserts the `icon` parameter into the tab header via `innerHTML` without proper escaping in the `app/src/layout/Tab.ts` file. This allows the injection of an `<img onerror=...>` element. Since the SiYuan Desktop renderer is configured with `nodeIntegration:true`, the injected JavaScript can access the Node.js `require` function and execute `require('child process').execSync(...)`, leading to arbitrary operating-system command execution. **Recommendations** Update SiYuan to version 3.7.2 or later.

**Name of the Vulnerable Software and Affected Versions** CyberChef versions prior to 11.2.0 **Description** The Series Chart operation allows prototype pollution when parsing user-supplied CSV data because it accepts ` proto ` as a key. Prototype pollution is a technique where an attacker manipulates the prototype of an object to change the behavior of the application. This flaw can be combined with other operations, such as Parse UDP, to inject malicious JavaScript into the HTML output. **Recommendations** Update to version 11.2.0.

**Name of the Vulnerable Software and Affected Versions** calibre versions prior to 9.10.0 **Description** A flaw exists where reading metadata from a malicious EPUB, OPF, or PDF file allows the execution of arbitrary Python code. This occurs when a custom column definition containing a `python:` template is embedded within `calibre:user metadata` and subsequently passed unsanitized to the `exec()` function in the template formatter. This can be triggered through actions such as Add books or Edit books. **Recommendations** Update to version 9.10.0.