← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-g275-mf26-qx9r: Stored XSS Escalating to Arbitrary Code Execution via Unescaped Checkbox Column Name (siyuan-note/siyuan)

[OFFICIALLY PUBLISHED BY VENDOR • PATCHED IN SiYuan v3.8.10]
Officially published by SiYuan maintainers (42,000+ ★) on 2026-11-01T05:07:13Z as GHSA-g275-mf26-qx9r (state: published, Critical severity, CVSS v3.1 9.6 / CVSS v4.0 9.4) with official author/reporter credit to @ccsimplyspolit, and patched in release v3.8.10.

0x00 // GitHub Security Advisory & Remediation Metadata

{
  "ghsa_id": "GHSA-g275-mf26-qx9r",
  "repository": "siyuan-note/siyuan",
  "package": "npm:SiYuan",
  "vulnerable_version_range": ">= 3.3.0, <= 3.8.9",
  "patched_versions": "v3.8.10",
  "html_url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-g275-mf26-qx9r",
  "state": "published",
  "published_at": "2026-11-01T05:07:13Z",
  "summary": "Stored XSS Escalating to Arbitrary Code Execution via Unescaped Checkbox Column Name in AttributeView Gallery and Kanban Renderers",
  "severity": "critical",
  "cvss_v3": {
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
    "score": 9.6,
    "severity": "CRITICAL"
  },
  "cvss_v4": {
    "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
    "score": 9.4,
    "severity": "CRITICAL"
  },
  "status": "Officially Published by Vendor (GHSA-g275-mf26-qx9r) • Patched in v3.8.10",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "reporter",
      "state": "accepted"
    }
  ],
  "cwe_ids": [
    "CWE-79",
    "CWE-94"
  ],
  "vulnerable_functions": [
    "renderAttributeView",
    "renderKanban"
  ]
}