CVE-2026-100643 - SiYuan before v3.8.4 Stored XSS via Attribute View textarea

Back Back to CVE browser

HIGH

SiYuan before v3.8.4 Stored XSS via Attribute View textarea

Published Sep 26, 2026

8.5

HIGH

CVSS 4.0

EPSS 0.42%

Description

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute stored JavaScript when other users open affected database menus, and in the Electron desktop app with nodeIntegration enabled, this leads to command execution with SiYuan process privileges.

Affected products

Vendor Siyuan-Note Product Siyuan Default
unaffected
- Version
  2.10.8
  Status
  affected
  Constraints
  <3.8.4
- Version
  3.8.4
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Siyuan-Note

Siyuan

unaffected

Version	Status	Constraints
2.10.8	affected	<3.8.4
3.8.4	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87737
Advisory
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h3p6-c22r-fx2j
exploitvendor-advisory
https://www.vulncheck.com/advisories/siyuan-before-3.8.4-stored-xss-via-attribute-view-textarea
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87737		Advisory
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h3p6-c22r-fx2j		exploitvendor-advisory
https://www.vulncheck.com/advisories/siyuan-before-3.8.4-stored-xss-via-attribute-view-textarea		third-party-advisory