CVE-2026-100643: SiYuan stored XSS in Attribute View textarea elements

CVE-2026-100643 · Severity: high · CVSS 8 · Published 2026-09-26

SiYuan is a local-first personal knowledge management application. Versions before 3.8.4 fail to properly escape user-supplied input in Attribute View field descriptions, template sources, select option descriptions, and footer calculation templates. An authenticated attacker can inject malicious JavaScript that executes when other users open affected database menus, and in the Electron desktop application this leads to arbitrary command execution with SiYuan process privileges.

Technologies: SiYuan. Vendors: SiYuan.

Quick answers

Is CVE-2026-100643 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-100643 being exploited in the wild.
How severe is CVE-2026-100643?
High severity, with a CVSS score of 8, published 26 September 2026.
Which products and versions are affected?
SiYuan 2.10.8 to 3.8.3.
Is there a fix for CVE-2026-100643?
A patch was published on 2026-09-26: Fixed in v3.8.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100643 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-100643?
Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored XSS flaw in four textarea sink locations (col.ts, select.ts, and calc.ts) where user-controlled values are inserted into HTML without proper escaping. An incomplete prior fix for a related advisory left the oldDesc field in showColMenu() unescaped while three sibling textarea elements also remain vulnerable. An attacker with authentication can craft payloads that close the textarea tag and inject event handlers, executing arbitrary JavaScript in the renderer process; in the Electron app with nodeIntegration enabled and contextIsolation disabled, this allows Node.js module access and command execution.

Affected products

  • SiYuan SiYuan 2.10.8 to 3.8.3

Timeline

  • 2026-09-26: disclosed: Published as GHSA-h3p6-c22r-fx2j and CVE-2026-100643
  • 2026-09-26: patched: Fixed in v3.8.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.