What is CVE-2026-66396?

CVE-2026-66396 is a high-severity vulnerability in Siyuan-Note Siyuan, classified under Cross-site Scripting. CVSS score: 8.4/10. Published 2026-07-27.

How severe is CVE-2026-66396?

High severity. CVSS v3 base score is 8.4 out of 10.

XSS in Siyuan-Note Siyuan

CVE-2026-66396

SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (22.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H.

Affected products

Siyuan-note Siyuan — versions 0, 3.7.2

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-66396?: CVE-2026-66396 is a high-severity vulnerability in Siyuan-Note Siyuan, classified under Cross-site Scripting. CVSS score: 8.4/10. Published 2026-07-27.
How severe is CVE-2026-66396?: High severity. CVSS v3 base score is 8.4 out of 10.