CVE-2026-75916

In SiYuan through 3.7.3, genHintItemHTML() in app/src/protyle/hint/extend.ts concatenates block name, alias, and memo fields into HTML without escaping, enabling XSS via '((' autocomplete popups. Combined with nodeIntegration enabled, contextIsolation disabled, and no CSP, this escalates to arbit...

PT-2026-78382

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A cross-site scripting issue exists in the '' block-reference autocomplete hint popup. The function genHintItemHTML app/src/protyle/hint/extend.ts concatenates a candidate block's name, alias, and mem...