https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 21:57:12 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-357485 EUVD-2026-357485 https://cve.radiocsirt.org/vuln/euvd-2026-357485 https://cve.radiocsirt.org/vuln/fkie_cve-2026-75916 <p>SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the &#39;((&#39; block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a candidate block&#39;s name, alias, and memo fields are concatenated into the popup&#39;s HTML without escaping. An attacker who can set these metadata fields on a block can inject a self-firing payload (e.g. &lt;img src=x onerror=...&gt;) that executes automatically when a victim types &#39;((&#39; followed by a search term that surfaces the crafted block. Because SiYuan&#39;s Electron windows run with nodeIntegration enabled, contextIsolation disabled, and no CSP, the injected script gains require(&#39;child_process&#39;) access, allowing the XSS to escalate to arbitrary OS command execution.</p> <p>SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the &#39;((&#39; block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a candidate block&#39;s name, alias, and memo fields are concatenated into the popup&#39;s HTML without escaping. An attacker who can set these metadata fields on a block can inject a self-firing payload (e.g. &lt;img src=x onerror=...&gt;) that executes automatically when a victim types &#39;((&#39; followed by a search term that surfaces the crafted block. Because SiYuan&#39;s Electron windows run with nodeIntegration enabled, contextIsolation disabled, and no CSP, the injected script gains require(&#39;child_process&#39;) access, allowing the XSS to escalate to arbitrary OS command execution.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-75916 https://cve.radiocsirt.org/vuln/ghsa-962c-hgx6-ffmx <p>SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the &#39;((&#39; block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a candidate block&#39;s name, alias, and memo fields are concatenated into the popup&#39;s HTML without escaping. An attacker who can set these metadata fields on a block can inject a self-firing payload (e.g. &lt;img src=x onerror=...&gt;) that executes automatically when a victim types &#39;((&#39; followed by a search term that surfaces the crafted block. Because SiYuan&#39;s Electron windows run with nodeIntegration enabled, contextIsolation disabled, and no CSP, the injected script gains require(&#39;child_process&#39;) access, allowing the XSS to escalate to arbitrary OS command execution.</p> <p>SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the &#39;((&#39; block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a candidate block&#39;s name, alias, and memo fields are concatenated into the popup&#39;s HTML without escaping. An attacker who can set these metadata fields on a block can inject a self-firing payload (e.g. &lt;img src=x onerror=...&gt;) that executes automatically when a victim types &#39;((&#39; followed by a search term that surfaces the crafted block. Because SiYuan&#39;s Electron windows run with nodeIntegration enabled, contextIsolation disabled, and no CSP, the injected script gains require(&#39;child_process&#39;) access, allowing the XSS to escalate to arbitrary OS command execution.</p> https://cve.radiocsirt.org/vuln/ghsa-962c-hgx6-ffmx