CVE-2026-65605

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.2

Description A stored cross-site scripting issue exists in the Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping. The EscapeHTML function is only triggered when HasUnclosedHtmlTag() returns true. Since balanced self-closing tags, such as <img>, bypass this check, malicious payloads can be stored unescaped and later inserted into the page via innerHTML. In the desktop renderer, where nodeIntegration is enabled, the injected script can access the require function, potentially leading to arbitrary command execution.

Recommendations Update SiYuan to version 3.7.2 or later.