Lute is a structured Markdown engine supporting Go and JavaScript. Lute 1.7.6 and earlier (as used in SiYuan before) has a Stored Cross-Site Scripting (XSS) vulnerability in the Markdown rendering engine. An attacker can inject malicious JavaScript into a Markdown text/note. When another user clicks the rendered content, the script executes in the context of their session.
References
| Link | Resource |
|---|---|
| https://github.com/88250/lute/commit/0118e218916cf0cc7df639b50ce74e0c6c3d1868 | Patch |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rw25-98wq-76qv | Exploit Vendor Advisory |
Configurations
History
24 Feb 2026, 20:59
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:b3log:siyuan:3.5.4:-:*:*:*:*:*:* | |
| First Time |
B3log
B3log siyuan |
|
| References | () https://github.com/88250/lute/commit/0118e218916cf0cc7df639b50ce74e0c6c3d1868 - Patch | |
| References | () https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rw25-98wq-76qv - Exploit, Vendor Advisory |
06 Feb 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-06 19:16
Updated : 2026-02-24 20:59
NVD link : CVE-2026-25647
Mitre link : CVE-2026-25647
CVE.ORG link : CVE-2026-25647
JSON object : View
Products Affected
b3log
- siyuan
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')