What is GHSA-jwj6-pgg9-m3v5?

GHSA-jwj6-pgg9-m3v5 is a security advisory published by GitHub Security Advisories with Critical severity. SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation...

Which CVE IDs does GHSA-jwj6-pgg9-m3v5 cover?

GHSA-jwj6-pgg9-m3v5 covers the following CVE IDs: CVE-2026-74902. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jwj6-pgg9-m3v5?

GHSA-jwj6-pgg9-m3v5 has a CVSS v3 base score of 8.6, published by GitHub Security Advisories.

GHSA-jwj6-pgg9-m3v5CriticalCVSS 8.6

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation...

Vendor

GitHub Security Advisories

Published

August 18, 2026

Last Modified

August 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-74902 →

📋 Description

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access when a user drags, drops, or pastes the file into the editor.

🔗 References (4)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jf56-jrhq-j2qp
https://nvd.nist.gov/vuln/detail/CVE-2026-74902
https://www.vulncheck.com/advisories/siyuan-before-xss-to-rce-via-malicious-filename-upload
https://github.com/advisories/GHSA-jwj6-pgg9-m3v5