---
id: CVE-2026-65605
title: >-
  SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in
  Attribute View (database) cell rendering
summary: >-
  SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in
  Attribute View (database) cell rendering. A Template column value is rendered
  as HTML via text/template without auto-escaping, and EscapeHTML is only
  applied wh…
severity: critical
cvss: 9.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'
cwe:
  - CWE-79
vendor: siyuan-note
product: siyuan
affected:
  - siyuan < 3.7.2
published: '2026-07-23'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T18:17:00.647'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-65605'
references:
  - url: >-
      https://github.com/siyuan-note/siyuan/commit/41f2861c87575ff5ac4b50a0520b1a4fe55b4a70
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pw5c-qhf3-jhwh
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/siyuan-before-stored-xss-to-rce-via-attribute-view
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pw5c-qhf3-jhwh
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-07-23T15:23:13.200750Z'
epss: 0.00648
epssPercentile: 0.49309
ingestedAt: '2026-09-17T18:25:15.979Z'
---

## Overview

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced self-closing tags such as <img> are skipped by that check, a payload like <img src=x onerror=...> is stored unescaped and later inserted into the page via innerHTML, executing when the database is viewed. Because the desktop renderer runs with nodeIntegration enabled, the injected script can reach require and escalate to arbitrary command execution.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.