Get real-time updates on Telegram
CVE-2026-66396: siyuan 0 to before 3.7.2
CVE-2026-66396. CVSS 3.1 base score 8.4 (HIGH, Vendor/CNA). EPSS 0.00541 (percentile 0.44687), scored 22-Oct-2026.
Affected technology
siyuan · 0 to before 3.7.2
siyuan-note
Description’s affected range: before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · High privileges required · Passive user interaction
What an attacker can do
Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents. Vendor/CNA’s CVSS 4.0 assessment (base score 9.3/10) rates confidentiality, integrity and availability impact as high.
- CWE
- CWE-79
- CCR priority
- 33.7 /100 (P4)
- CVSS 3.1
- 8.4 /10 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H · Vendor/CNA
- EPSS
- 0.00541 · percentile 0.44745 · 2026-10-24
- KEV
- no
Provenance
- FIRST EPSS daily exploit-probability · Source record · observed 2026-10-24 15:09:16.138216+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-24 15:07:27.951960+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-66396.html