Hyuunnn

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced self-closing tags such as <img> are skipped by that check, a payload like <img src=x onerror=...> is stored unescaped and later inserted into the page via innerHTML, executing when the database is viewed. Because the desktop renderer runs with nodeIntegration enabled, the injected script can reach require and escalate to arbitrary command execution.

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it (app/src/layout/Tab.ts), allowing injection of an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node's require and call require('child process').execSync(...), escalating the cross-site scripting into arbitrary operating-system command execution.

**Name of the Vulnerable Software and Affected Versions** CyberChef versions prior to 11.2.0 **Description** The Series Chart operation allows prototype pollution when parsing user-supplied CSV data because it accepts ` proto ` as a key. Prototype pollution is a technique where an attacker manipulates the prototype of an object to change the behavior of the application. This flaw can be combined with other operations, such as Parse UDP, to inject malicious JavaScript into the HTML output. **Recommendations** Update to version 11.2.0.

**Name of the Vulnerable Software and Affected Versions** calibre versions prior to 9.10.0 **Description** A flaw exists where reading metadata from a malicious EPUB, OPF, or PDF file allows the execution of arbitrary Python code. This occurs when a custom column definition containing a `python:` template is embedded within `calibre:user metadata` and subsequently passed unsanitized to the `exec()` function in the template formatter. This can be triggered through actions such as Add books or Edit books. **Recommendations** Update to version 9.10.0.