Siyuan CVE-2026-39846

Attacker requires authenticated access (PR:L) to a SiYuan workspace that the victim also syncs-specifically, ability to create or import notes into shared workspace via SiYuan's collaboration/sync features. Victim must perform workspace synchronization action (pulling updates from shared workspace), then actively open the attacker-controlled note (UI:R required). Exploitation occurs only in SiYuan desktop client installations using Electron framework with nodeIntegration enabled and contextIsolation disabled (default configuration in affected versions prior to 3.6.4). Web-based or differently configured clients may not be vulnerable. Attack succeeds from network position (AV:N) because workspace sync operates over network protocols, but the multi-step prerequisite chain (shared workspace membership, victim sync timing, victim opening specific note) significantly constrains opportunistic exploitation. Single-user installations without workspace sync enabled are not vulnerable to the propagation vector, though local XSS-to-RCE still possible if attacker can directly modify local notes via other means.

Real-world risk assessment reveals conflicting signals requiring careful interpretation. CVSS 9.0 with scope change (S:C) correctly reflects the severity of breaking out of the application security boundary to achieve system-level code execution. However, practical exploitation requires multiple conditions: attacker must have authenticated access (PR:L) to create/import notes into a shared workspace, victim must sync their workspace (network-dependent action), and victim must actively open the malicious note (UI:R). EPSS score of 0.14% (34th percentile) indicates low current exploitation probability, suggesting limited attacker awareness or tooling despite the critical impact. No CISA KEV listing confirms no widespread active exploitation. Attack complexity is low (AC:L) once prerequisites are met-the XSS payload itself is straightforward. The SSVC framework assessment: exploitation=none (no public POC identified), automatable=no (requires social engineering to ensure victim opens note), technical impact=total (arbitrary code execution). Primary risk is in enterprise/team deployments where workspace sync creates trust relationships between users. Single-user installations face lower risk unless attacker can socially engineer note import. This is a genuine critical-severity issue for multi-user deployments, not a theoretical high-CVSS curiosity, but the low EPSS suggests attackers have not yet weaponized it at scale.

Attacker with legitimate credentials to a shared SiYuan workspace crafts a note containing malicious JavaScript in a table caption field (e.g., <caption><img src=x onerror='require("child_process").exec("calc.exe")'></caption>). Attacker imports this note into the shared workspace. When the victim syncs their SiYuan desktop client, the malicious note propagates to their local database. Upon opening the note, the table renders with the caption content unsafely inserted into HTML. The XSS payload executes in Electron's renderer context with Node.js API access enabled, directly invoking child_process to execute arbitrary system commands (credential theft, ransomware deployment, persistence mechanisms) with the victim's OS-level privileges. No public POC identified at time of analysis, but exploitation logic is straightforward for attackers familiar with Electron security weaknesses.