CVE-2026-65605
SiYuan before version 3.7.2 contains a stored cross‑site scripting flaw that can let an attacker run arbitrary code when a user opens a database. The flaw arises because template values are rendered as raw HTML without proper escaping. Upgrading to 3.7.2 or later removes the vulnerability.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
SiYuan desktop application, any version before 3.7.2, used by individuals or teams who create or view databases with template columns.
Real-world impact
An attacker can inject malicious JavaScript that runs with the application's privileges, potentially allowing them to execute arbitrary commands on the victim's machine.
Why this severity
The CVSS score of 9.4 reflects the high impact: the vulnerability is exploitable over the network, requires no authentication, and can lead to full compromise because the injected script runs with nodeIntegration enabled, giving access to the file system and command execution.
What to do about it
- 01Upgrade SiYuan to version 3.7.2 or later.
- 02Restart the application.
NVD-referenced vendor advisory
Timeline
- Jul 23, 2026 · 9d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 9d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.