CVE-2026-66396CWE-79cross-site-scripting

CVE-2026-66396

High · published July 27, 2026

CVSS v3.1
8.4
EPSS
1%
Percentile
44.7
In the wild
Unconfirmed
What it is

SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00541 · 44.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-27T20:18Z
References (3)
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5rxg-wh59-mg34 · [email protected]https://www.vulncheck.com/advisories/siyuan-before-stored-xss-to-rce-via-title-img-ial · [email protected]https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5rxg-wh59-mg34 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 JUL 15:43Z
    SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL
    cvelistv5