PT-2026-99316 · Siyuan · Siyuan
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
SiYuan versions 3.7.0 through 3.8.3
Description
A stored cross-site scripting issue exists in the gallery and kanban database renderers because field descriptions are not escaped in
aria-label attributes. In the Electron desktop application when nodeIntegration is enabled, this allows the injection of JavaScript that can call Node.js child process APIs to execute arbitrary commands with user privileges.Recommendations
Update SiYuan to version 3.8.4 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Siyuan