Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: siyuan-note siyuan 3.7.2 Clear all filters
TI-2026-47155 CVE-2026-66396 · GHSA-pwp5-qq97-mcqc

SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL

Priority HIGH 75

SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation.

CVSS 4.0CRITICAL 9.3 Network High privileges User interaction EPSS 0.00541 Published 2026-07-27 Fixed in 3.7.2 CWE-79
TI-2026-47154 CVE-2026-66395 · GHSA-x52j-m89g-wh64

SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol

Priority HIGH 76

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link.

CVSS 4.0CRITICAL 9.4 Network No auth User interaction EPSS 0.00565 Published 2026-07-27 Fixed in 3.7.2 CWE-79