High severity · published Jul 27, 2026
CVE-2026-66396
SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL
8.4
CVSS
0.5%
EPSS
No
On KEV
Description
SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
siyuan · siyuan-note
before 3.7.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-66396
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-66396
github.com
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5rxg-wh59-mg34
www.vulncheck.com
https://www.vulncheck.com/advisories/siyuan-before-stored-xss-to-rce-via-title-img-ial
More from siyuan
10.0
CVE-2026-72811
SiYuan before v3.7.4 SQL Injection via backlink search
10.0
CVE-2026-69085
SiYuan before v3.7.3 SQL Injection via searchDocs
10.0
CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
10.0
CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
10.0
CVE-2026-66012
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP