CVE-2026-66396: SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL
SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66396?
The severity of CVE-2026-66396 is considered high with a score of 8.4.
What types of attacks are possible with CVE-2026-66396?
CVE-2026-66396 allows for stored cross-site scripting (XSS) that can lead to remote code execution (RCE).
Who is affected by CVE-2026-66396?
Users of SiYuan versions before v3.7.2 with editor permissions are affected by CVE-2026-66396.
How do I fix CVE-2026-66396?
To fix CVE-2026-66396, upgrade to SiYuan version 3.7.2 or later.
What is the nature of the vulnerability CWE associated with CVE-2026-66396?
CVE-2026-66396 is associated with the CWE classification for Cross-Site Scripting (XSS).