CVE-2026-25647: Lute has a Stored Cross-Site Scripting (XSS) via Markdown hyperlink
Lute is a structured Markdown engine supporting Go and JavaScript. Lute 1.7.6 and earlier (as used in SiYuan before) has a Stored Cross-Site Scripting (XSS) vulnerability in the Markdown rendering engine. An attacker can inject malicious JavaScript into a Markdown text/note. When another user clicks the rendered content, the script executes in the context of their session.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25647?
CVE-2026-25647 has a severity rating that indicates a significant risk due to its Stored Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2026-25647?
To fix CVE-2026-25647, upgrade Lute to version 1.7.7 or later to mitigate the XSS vulnerability.
What impact does CVE-2026-25647 have on applications using Lute?
CVE-2026-25647 allows attackers to inject malicious scripts, potentially compromising user data and security in applications using Lute.
Is my version of Lute vulnerable to CVE-2026-25647?
If you are using Lute version 1.7.6 or earlier, your installation is vulnerable to CVE-2026-25647.
Can I still use Lute if I cannot upgrade to a new version after CVE-2026-25647?
If you cannot upgrade, implementing input sanitization and validation can help reduce the risk of exploitation for CVE-2026-25647.