CVE-2026-66396

If you're running SiYuan, treat this as a critical severity regardless of the 8.4 CVSS score. The rating measures browser-XSS impact—cookie theft, session hijack—but this vulnerability lives in an Electron renderer with full Node.js access. That means arbitrary file reads, process execution, and complete compromise of everything your SiYuan instance can reach. The blastradius extends far beyond a single victim: SiYuan's local-first positioning encourages informal document sharing (.sy.zip files from colleagues, community templates, forum exports). You open that document trusting it's 'just local data,' and the payload activates automatically. Check whether your SiYuan instance runs with `nodeIntegration: true` and `contextIsolation: false` in its webPreferences. If so, this XSS isn't a content bug—it's evidence the security boundary between renderer and Node.js was never properly established. Patching the Individual Attribute List injection point will close this CVE, but without hardening the Electron configuration, you're one rendering path away from the same compromise again. The Individual Attribute List rendering path matters because it suggests structured user data flows into style contexts without consistent sanitization. Examine whether other structured data fields (document properties, tag rendering, backlink content) share the same interpolation logic—they likely weren't audited. Ongoing risk: every .sy.zip file shared today sits in someone's knowledge base for months or years. Unlike web XSS where you must lure victims to malicious sites, this payload delivers itself through trusted document workflows. The exposure surface grows with each export, template share, and backup. Prioritize patching and hardening the Electron security model simultaneously.

Reviewed through automated stages and approved by a human before publication.