Vulnerability · Published Jul 27, 2026 · Assigned by VulnCheck

CVE-2026-66396SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL

High 8.4

In plain English

A high-severity cross-site scripting in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)0.5%top 54.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents.

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	0 – before 3.7.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-5rxg-wh59-mg34) vendor-advisory
VulnCheck Advisory: SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL third-party-advisory