https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T16:23:35.273243+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-371340 EUVD-2026-371340 2026-10-17T16:23:35.326999+00:00 EUVD-2026-371340 https://cve.radiocsirt.org/vuln/fkie_cve-2026-65606 fkie_cve-2026-65606 2026-10-17T16:23:35.327042+00:00

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it (app/src/layout/Tab.ts), allowing injection of an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node's require and call require('child_process').execSync(...), escalating the cross-site scripting into arbitrary operating-system command execution.

 https://cve.radiocsirt.org/vuln/ghsa-3vr3-hq5c-q2w9 GHSA-3vr3-hq5c-q2w9 2026-10-17T16:23:35.327080+00:00

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it (app/src/layout/Tab.ts), allowing injection of an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node's require and call require('child_process').execSync(...), escalating the cross-site scripting into arbitrary operating-system command execution.