CVE-2026-65605 in SiYuan
Summary
by MITRE • 07/23/2026
SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced self-closing tags such as <img> are skipped by that check, a payload like <img src=x onerror=...> is stored unescaped and later inserted into the page via innerHTML, executing when the database is viewed. Because the desktop renderer runs with nodeIntegration enabled, the injected script can reach require and escalate to arbitrary command execution.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability in SiYuan before version 3.7.2 represents a critical stored cross-site scripting flaw that undermines the application's security posture through improper HTML sanitization in the Attribute View component. This issue manifests when template column values are rendered using text/template without automatic escaping mechanisms, creating an environment where malicious payloads can persist and execute within the application's database interface. The vulnerability stems from a flawed conditional logic where EscapeHTML is only invoked when HasUnclosedHtmlTag returns true, leaving balanced self-closing HTML tags like <img> unprotected from XSS attacks.
The technical implementation of this flaw demonstrates a fundamental misunderstanding of HTML sanitization principles and input validation. When users create or modify database entries containing template columns with HTML content, the application fails to properly escape potentially malicious code segments that could be embedded within otherwise benign tags. This oversight creates a persistent vulnerability where attackers can inject JavaScript payloads that remain dormant until the affected database view is accessed by another user, making it particularly dangerous for collaborative environments where multiple users interact with shared data repositories.
The operational impact of this vulnerability extends far beyond simple XSS exploitation due to SiYuan's desktop application architecture which enables nodeIntegration. This configuration allows malicious scripts injected through the XSS vector to access Node.js native modules and APIs through the require function, providing attackers with direct system-level access. The combination of stored XSS with elevated privileges through nodeIntegration creates a severe threat vector that can lead to complete system compromise, data exfiltration, and persistent backdoor installation. Attackers could leverage this vulnerability to execute arbitrary commands on affected systems, potentially gaining control over the entire machine where SiYuan is installed.
Security practitioners should recognize this vulnerability as a classic example of CWE-79 (Cross-site Scripting) combined with improper input validation and privilege escalation through application architecture design flaws. The ATT&CK framework categorizes this threat under T1059 (Command and Scripting Interpreter) and potentially T1068 (Local Privilege Escalation) depending on the execution context and system permissions. Organizations using SiYuan should immediately implement mitigations including updating to version 3.7.2 or later, implementing additional input validation layers, and conducting comprehensive security reviews of all HTML rendering components within the application. The vulnerability also highlights the importance of secure coding practices around HTML sanitization, particularly when dealing with user-generated content in applications that maintain elevated privileges through frameworks like Electron that support nodeIntegration.
This issue demonstrates how seemingly minor implementation flaws in HTML processing can create cascading security problems when combined with application architecture decisions that provide excessive privilege levels to rendered content. The vulnerability serves as a reminder of the critical need for comprehensive security testing including both static code analysis and dynamic runtime evaluation, particularly in applications that process untrusted data through complex rendering pipelines. Organizations should prioritize regular security assessments of their Electron-based applications and implement robust input sanitization frameworks that do not rely on conditional logic that can be bypassed by specific HTML tag structures.