Vulnerability Description
SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can set these metadata fields on a block can inject a self-firing payload (e.g. <img src=x onerror=...>) that executes automatically when a victim types '((' followed by a search term that surfaces the crafted block. Because SiYuan's Electron windows run with nodeIntegration enabled, contextIsolation disabled, and no CSP, the injected script gains require('child_process') access, allowing the XSS to escalate to arbitrary OS command execution.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5prr-vgxq-69g9
- https://www.vulncheck.com/advisories/siyuan-xss-to-rce-via-unescaped-block-metad
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5prr-vgxq-69g9
FAQ
What is CVE-2026-75916?
CVE-2026-75916 is a vulnerability with a CVSS score of 8.6 (HIGH). SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a candidate block's name,...
How severe is CVE-2026-75916?
CVE-2026-75916 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-75916?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.