CVE-2026-65605— siyuan-note siyuan 跨站脚本漏洞

SiYuan before v3.7.2 Stored XSS to RCE via Attribute View

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced self-closing tags such as <img> are skipped by that check, a payload like <img src=x onerror=...> is stored unescaped and later inserted into the page via innerHTML, executing when the database is viewed. Because the desktop renderer runs with nodeIntegration enabled, the injected script can reach require and escalate to arbitrary command execution.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

siyuan-note siyuan 跨站脚本漏洞

SiYuan是SiYuan团队的一款文档管理与企业应用软件。 siyuan-note siyuan 3.7.2之前版本存在跨站脚本漏洞，该漏洞源于Attribute View（数据库）单元格渲染中的模板列值通过text/template以HTML形式呈现且未自动转义，EscapeHTML仅在HasUnclosedHtmlTag返回true时应用，由于平衡自闭合标签（如<img>）被该检查跳过，导致特制有效载荷被存储未转义并通过innerHTML插入页面，查看数据库时执行，且由于桌面渲染器启用了nodeIn

N/A

N/A