CVE-2026-65605 is a stored cross-site scripting vulnerability in SiYuan note-taking software before version 3.7.2. The issue occurs in the Attribute View's database cell rendering where a Template column value is rendered as HTML using text/template without sufficient escaping. The EscapeHTML function is conditionally applied only when unclosed HTML tags are detected, but balanced self-closing tags like <img> are skipped, allowing payloads such as <img src=x onerror=...> to be stored unescaped. When the database is viewed, this payload is inserted into the page via innerHTML, triggering script execution. Because the desktop renderer enables nodeIntegration, the injected script can access Node.js require and escalate to arbitrary command execution on the user's system.

Successful exploitation allows an attacker to execute arbitrary JavaScript code in the context of the SiYuan desktop application. Due to nodeIntegration being enabled, this can escalate to arbitrary command execution on the host machine, posing a critical security risk including full system compromise.

A fix is available in SiYuan version 3.7.2 and later. Users should upgrade to version 3.7.2 or newer to remediate this vulnerability. Patch status is not explicitly confirmed in the vendor advisory, but the affected versions are stated as prior to 3.7.2, indicating the issue is resolved in 3.7.2. No additional mitigation steps are provided.