Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-100643— SiYuan before v3.8.4 Stored XSS via Attribute View textarea

Quick assessment

Affected
siyuan-note siyuan
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

思源笔记（SiYuan）在 v3.8.4 版本之前，未能正确转义存储在 textarea 元素中的四个属性视图（Attribute View）值，导致经过身份验证的攻击者可以通过修改字段描述、模板源码、选项描述或页脚计算模板等方式注入 JavaScript 代码。当其他用户打开受影响的数据库菜单时，这些已存储的 JavaScript 代码将被执行。此外，在启用了 nodeIntegration 的 Electron 桌面应用中，此类攻击可导致以思源笔记进程权限执行系统命令。

CVSS 8.0 · High EPSS 0.42% · P34
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-100643

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SiYuan before v3.8.4 Stored XSS via Attribute View textarea
Source: CVE Program / CVE List V5
Vulnerability Description
SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute stored JavaScript when other users open affected database menus, and in the Electron desktop app with nodeIntegration enabled, this leads to command execution with SiYuan process privileges.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
siyuan-note siyuan 2.10.8 ~ 3.8.4 -

II. Public POCs for CVE-2026-100643

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-100643

请登录查看更多情报信息。

Other References for CVE-2026-100643 (1)

Other References for CVE-2026-100643 (1)

Same Patch Batch · siyuan-note · 2026-09-26 · 14 CVEs total

CVE-2026-100639 8.8 HIGH SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL
CVE-2026-100646 8.1 HIGH SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header
CVE-2026-100645 8.0 HIGH SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban
CVE-2026-100641 8.0 HIGH SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content
CVE-2026-100642 7.6 HIGH SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth
CVE-2026-100637 7.6 HIGH SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID
CVE-2026-100638 7.6 HIGH SiYuan before v3.8.4 Path Traversal via setNotebookIcon
CVE-2026-100636 7.6 HIGH SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder
CVE-2026-100644 7.5 HIGH SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath
CVE-2026-100633 6.5 MEDIUM SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations
CVE-2026-100635 5.9 MEDIUM SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie
CVE-2026-100634 4.7 MEDIUM SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows
CVE-2026-100640 4.7 MEDIUM SiYuan before v3.8.4 Clipboard Data Disclosure via IPC

IV. Related Vulnerabilities

Same product: siyuan
Same vendor: siyuan-note
Same weakness: CWE-79

V. Comments for CVE-2026-100643

No comments yet

Leave a comment