SiYuan before v3.7.2: Critical Stored XSS and Auth Bypass Vulnerabilities
SiYuan versions prior to 3.7.2 are affected by multiple critical vulnerabilities, including stored cross-site scripting and missing authorization, that can lead to remote code execution and administrator takeover.
What happened
SiYuan before version 3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering (CVE-2026-65605). A Template column value is rendered as HTML without proper escaping, allowing an attacker to inject a payload like <img src=x onerror=...> that executes when the database is viewed. Because the desktop renderer runs with nodeIntegration enabled, the injected script can escalate to arbitrary command execution.
SiYuan before version 3.7.2 also contains a cross-site scripting vulnerability in the siyuan:// protocol handler (CVE-2026-65606). When a siyuan://plugins/<name> link references a non-installed plugin, the application inserts the link's icon parameter into the tab header without escaping it, allowing injection of an <img onerror=...> element. The injected JavaScript can access Node's require and call require('child_process').execSync(...), escalating the cross-site scripting into arbitrary operating-system command execution.
Additionally, SiYuan before version 3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint (CVE-2026-66012). This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy actions across the entire workspace. When the Publish server is enabled in anonymous mode, a remote unauthenticated attacker can reach /mcp, read sensitive configuration files, write arbitrary files, and plant a plugin that executes with nodeIntegration:true and no contextIsolation on the next desktop launch, leading to administrator takeover.
How 0Day mitigates this
siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.