CVE-2026-100641Published
SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-100641 · Microsoft / collected KEV context
cve-program · CVE-2026-100641
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2mmf-4xwm-55rm
- https://github.com/siyuan-note/siyuan/commit/1ecb1c07de497ff03b585536fe5579291754d96b
- https://github.com/siyuan-note/siyuan/commit/48c354e7de130aaada9d7120125bbc768344fd3b
- https://github.com/siyuan-note/siyuan/commit/41b14025b4ac4a8379d1200580344ca18ad152b7
- https://github.com/siyuan-note/siyuan/commit/8641553a1f07374001902d3ce773285db1292b2d
- https://www.vulncheck.com/advisories/siyuan-before-3.8.4-stored-xss-via-unescaped-flashcard-content
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.