A critical stored cross-site scripting flaw in SiYuan's database cell rendering can escalate to arbitrary command execution on the desktop app, with a CVSS 3.1 base score of 9.6.
What Is It
CVE-2026-65605 is a stored cross-site scripting vulnerability (CWE-79) in SiYuan's Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping. EscapeHTML is only applied when HasUnclosedHtmlTag returns true, so balanced self-closing tags such as <img> are skipped by that check. A payload like <img src=x onerror=...> is stored unescaped and later inserted into the page via innerHTML, executing when the database is viewed. Because the desktop renderer runs with nodeIntegration enabled, the injected script can reach require and escalate to arbitrary command execution.
Why It Matters
The flaw carries a CVSS 3.1 base score of 9.6 (CRITICAL), with a network attack vector, low attack complexity, no privileges required, and a changed scope. Confidentiality, integrity, and availability impacts are all rated HIGH. Because the stored payload fires simply when a victim views the affected database, and the desktop renderer's nodeIntegration allows escalation from browser-context script to OS command execution, an attacker can move from a persisted note entry to full code execution on the victim's machine.
What's Vulnerable
SiYuan (vendor: siyuan-note) versions before 3.7.2 are affected. Version 3.7.2 and later are unaffected. User interaction is required; the victim must view the database containing the malicious Template column value.
Patch Status
The issue is fixed in SiYuan v3.7.2; the vendor addressed it in commit 41f2861c87575ff5ac4b50a0520b1a4fe55b4a70, documented in security advisory GHSA-pw5c-qhf3-jhwh. Users should upgrade to v3.7.2 or later. This CVE is not present in the CISA KEV catalog in the supplied data, so there is no confirmation of active exploitation.
Sources
- NVD, CVE-2026-65605
- SiYuan GitHub Advisory (GHSA-pw5c-qhf3-jhwh): https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pw5c-qhf3-jhwh
- SiYuan fix commit: https://github.com/siyuan-note/siyuan/commit/41f2861c87575ff5ac4b50a0520b1a4fe55b4a70
- VulnCheck Advisory: https://www.vulncheck.com/advisories/siyuan-before-stored-xss-to-rce-via-attribute-view