CVE-2026-65605

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced self-closing tags such as <img> are skipped by that check, a payload like <img src=x onerror=...> is stored unescaped and later inserted into the page via innerHTML, executing when the database is viewed. Because the desktop renderer runs with nodeIntegration enabled, the injected script can reach require and escalate to arbitrary command execution.

• CWE-79

• https://github.com/siyuan-note/siyuan/commit/41f2861c87575ff5ac4b50a0520b1a4fe55b4a70
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pw5c-qhf3-jhwh
• https://www.vulncheck.com/advisories/siyuan-before-stored-xss-to-rce-via-attribute-view
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pw5c-qhf3-jhwh

Published

Jul 23, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6560A security vulnerability has been detected in H3C Magic B0 u…8.8
• CVE-2026-65600Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v…5.3
• CVE-2026-65601Traefik versions 3.7.0 through 3.7.6 contain a namespace con…5.3
• CVE-2026-65602Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to…8.8
• CVE-2026-65603The Grav Login plugin (grav-plugin-login) versions <= 3.8.11…8.8
• CVE-2026-65604Skipper contains an incomplete fix for CVE-2026-50197 in whi…8.8
• CVE-2026-65606SiYuan before v3.7.2 contains a cross-site scripting vulnera…9.6
• CVE-2026-65607SiYuan before v3.7.2 contains a path traversal vulnerability…7.1
• CVE-2026-65608Grav versions >= 1.7.0 and before 2.0.9 contain a remote cod…8.8
• CVE-2026-6561A vulnerability was detected in EyouCMS up to 1.7.1. This is…4.7
• CVE-2026-65616Incorrect authorization validation in refresh token signatur…8.8
• CVE-2026-65617A deserialization weakness in JFrog Artifactory package hand…8.8