High severity · published Sep 26, 2026
CVE-2026-100643
SiYuan before v3.8.4 Stored XSS via Attribute View textarea
8.0
CVSS
0.5%
EPSS
No
On KEV
Description
SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute stored JavaScript when other users open affected database menus, and in the Electron desktop app with nodeIntegration enabled, this leads to command execution with SiYuan process privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
siyuan · siyuan-note
2.10.8 before 3.8.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100643
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100643
vendor-advisory
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h3p6-c22r-fx2j
third-party-advisory
https://www.vulncheck.com/advisories/siyuan-before-3.8.4-stored-xss-via-attribute-view-textarea
More from siyuan
10.0
CVE-2026-72811
SiYuan before v3.7.4 SQL Injection via backlink search
10.0
CVE-2026-69085
SiYuan before v3.7.3 SQL Injection via searchDocs
10.0
CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
10.0
CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
10.0
CVE-2026-66012
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP