Количество 3
Количество 3
CVE-2026-40922
SiYuan is an open-source personal knowledge management system. In versions 3.6.1 through 3.6.3, a prior fix for XSS in bazaar README rendering (incomplete fix for CVE-2026-33066) enabled the Lute HTML sanitizer, but the sanitizer does not block iframe tags, and its URL-prefix blocklist does not effectively filter srcdoc attributes which contain raw HTML rather than URLs. A malicious bazaar package author can include an iframe with a srcdoc attribute containing embedded scripts in their README. When other users view the package in SiYuan's marketplace UI, the payload executes in the Electron context with full application privileges, enabling arbitrary code execution on the user's machine. This issue has been fixed in version 3.6.4.
GHSA-8q5w-mmxf-48jg
SiYuan has incomplete fix for CVE-2026-33066: XSS
BDU:2026-07547
Уязвимость системы управления персональными знаниями SiYuan, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю выполнить произвольный код
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-40922 SiYuan is an open-source personal knowledge management system. In versions 3.6.1 through 3.6.3, a prior fix for XSS in bazaar README rendering (incomplete fix for CVE-2026-33066) enabled the Lute HTML sanitizer, but the sanitizer does not block iframe tags, and its URL-prefix blocklist does not effectively filter srcdoc attributes which contain raw HTML rather than URLs. A malicious bazaar package author can include an iframe with a srcdoc attribute containing embedded scripts in their README. When other users view the package in SiYuan's marketplace UI, the payload executes in the Electron context with full application privileges, enabling arbitrary code execution on the user's machine. This issue has been fixed in version 3.6.4. | CVSS3: 5.4 | 0% Низкий | 4 месяца назад |
| GHSA-8q5w-mmxf-48jg SiYuan has incomplete fix for CVE-2026-33066: XSS | CVSS3: 5.4 | 0% Низкий | 4 месяца назад |
 | BDU:2026-07547 Уязвимость системы управления персональными знаниями SiYuan, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю выполнить произвольный код | CVSS3: 5.4 | 0% Низкий | 5 месяцев назад |
Уязвимостей на страницу