CVE-2026-25647: b3log Siyuan

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Lute is a structured Markdown engine supporting Go and JavaScript. Lute 1.7.6 and earlier (as used in SiYuan before) has a Stored Cross-Site Scripting (XSS) vulnerability in the Markdown rendering engine. An attacker can inject malicious JavaScript into a Markdown text/note. When another user clicks the rendered content, the script executes in the context of their session.

Affected products

• b3log Siyuan: version 3.5.4 only

Published 2026-02-06. Last modified 2026-06-17.