CVE-2026-25647 — Lute has a Stored Cross-Site Scripting (XSS) via Markdown hyperlink
Lute is a structured Markdown engine supporting Go and JavaScript. Lute 1.7.6 and earlier (as used in SiYuan before) has a Stored Cross-Site Scripting (XSS) vulnerability in the…
Published: 2026-02-06 · CVSS: 4.6 · CVSS 3.1
Lute is a structured Markdown engine supporting Go and JavaScript. Lute 1.7.6 and earlier (as used in SiYuan before) has a Stored Cross-Site Scripting (XSS) vulnerability in the Markdown rendering engine. An attacker can inject malicious JavaScript into a Markdown text/note. When another user clicks the rendered content, the script executes in the context of their session.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7