HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-66396 — SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List val...

·Source: NIST NVD

Updated:

Executive Summary

SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents.

Analysis

SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents. CVSS Score: 8.4. Published: 2026-07-27T16:18:12.220.

Indicators of Compromise (1)

CVE (1)
CVE-2026-66396
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 27, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

For Some, So-Called ‘Skynet Day’ Came too Close to Sci-Fi After a Rogue Agent Hacked Into a Startup

Decades after it appeared in “The Terminator,” Skynet looks more like a forecast of the cyber incident in which a rogue AI system hacked into another AI company on its own. The post For Some, So-Called ‘Skynet Day’ Came too Close to Sci-Fi After a Rogue Agent Hacked Into a Startup appeared first on SecurityWeek .

SecurityWeek
MEDIUMVulnerability

Circle buys IBM's blockchain patent portfolio

Stablecoin issuer Circle Internet Finance has acquired nearly 1000 blockchain-related patents from IBM.

Finextra
MEDIUMVulnerability

Wyden Calls for Edge Device Annihilation in US Government

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/wyden-calls-for-edge-device-annihilation-in-us-government-image_small-6-a-32344.jpg" align=right hspace=4><b>US Senator Says Zero Trust Must Replace Legacy Edge Devices in 2028</b><br>Network devices conversion into nation-state hackers' favorite initial access vector has a U.S. senator urging the federal government to phase out l

Bank Info Security