EUVD-2026-17676
GHSA-68p4-j234-43mv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (Access-Control-Allow-Origin: * + Access-Control-Allow-Private-Network: true) to inject a JavaScript snippet via the API. The injected snippet executes in Electron's Node.js context with full OS access the next time the user opens SiYuan's UI. No user interaction is required beyond visiting the malicious website while SiYuan is running. This issue has been patched in version 3.6.2.
AnalysisAI
Remote code execution in SiYuan desktop application (versions prior to 3.6.2) allows unauthenticated remote attackers to execute arbitrary code with full operating system privileges through CORS misconfiguration. A malicious website can inject JavaScript into the Electron-based application's Node.js context via the permissive API (Access-Control-Allow-Origin: * with Access-Control-Allow-Private-Network: true), which executes with OS-level access when the user next opens SiYuan's interface. No public exploit identified at time of analysis, though CVSS 9.6 (Critical) reflects network-accessible attack vector with low complexity requiring only user interaction (visiting malicious site while SiYuan runs). EPSS data not provided, but the combination of Electron framework exploitation, RCE impact, and trivial attack complexity suggests elevated real-world risk for desktop users.
Technical ContextAI
SiYuan is an Electron-based personal knowledge management system that embeds a local API server. The vulnerability stems from CWE-942 (Overly Permissive Cross-Origin Resource Sharing), where the application's API endpoints expose wildcard CORS headers (Access-Control-Allow-Origin: *) combined with Access-Control-Allow-Private-Network: true. This configuration allows any website origin to make authenticated requests to SiYuan's localhost API. In Electron applications, JavaScript executed within the renderer process can access Node.js APIs if nodeIntegration is enabled or context isolation is improperly configured. The attack chain involves: (1) victim visits attacker-controlled website while SiYuan runs, (2) malicious JavaScript uses permissive CORS to inject payloads via SiYuan's API, (3) injected code persists and executes in Electron's privileged Node.js context on next UI launch, granting full filesystem and process execution capabilities. This represents a critical architectural flaw in Electron security boundaries where web content can bridge into native OS access.
RemediationAI
Upgrade immediately to SiYuan version 3.6.2 or later, released February 2025, which patches the permissive CORS configuration. The vendor-released patch is available at https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2 and addresses the API security boundary by restricting cross-origin access. Users should verify the installed version and apply updates through the application's built-in update mechanism or by downloading the patched release directly from the GitHub releases page. No workarounds are documented; upgrading is the only confirmed remediation. After upgrading, review any custom plugins or scripts for similar CORS misconfigurations. Organizations deploying SiYuan should audit endpoint exposure and consider network segmentation to limit localhost API accessibility. Refer to the security advisory at https://github.com/siyuan-note/siyuan/security/advisories/GHSA-68p4-j234-43mv for additional technical details.
More in Cors Misconfiguration
View allCasdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9
A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical
Permissive CORS policy in ericc-ch copilot-api up to version 0.7.0 allows remote attackers to access the Token Endpoint
Cross-origin data exposure in Google's MCP Toolbox for Databases stems from the SSE initialization handler unconditional
Cross-origin data theft in LightRAG server versions prior to 1.5.4 allows any malicious website to make authenticated, c
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today