Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100643SiYuan before v3.8.4 Stored XSS via Attribute View textarea

High 8.0

In plain English

A high-severity cross-site scripting in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.5%top 55.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute stored JavaScript when other users open affected database menus, and in the Electron desktop app with nodeIntegration enabled, this leads to command execution with SiYuan process privileges.

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	2.10.8 – before 3.8.4

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-h3p6-c22r-fx2j) vendor-advisory
VulnCheck Advisory: SiYuan before v3.8.4 Stored XSS via Attribute View textarea third-party-advisory