XSS in Siyuan-note Siyuan

CVE-2026-54759

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, Lute's HTML sanitizer does not remove <iframe> elements. Combined with the SiYuan Electron client's permissive security configuration, an attacker can include a…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (17.9th percentile) — read the EPSS interpretation.