Threats tagged 'ghsa-65ff-h86c-m5g9'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.4	EPSS 0.5%	CVE-2026-73052siyuan · Cross-site Scripting Critical9.4EPSS 0.5%2026-08-15CVE Database V5CVE-2026-73052 SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node integration enabled in the desktop client enabling code execution. EPSS 0.5%Vulnerability siyuan-note #ghsa-65ff-h86c-m5g9	CVE Database V5	2026-08-15

Page 1 of 1