What is the CVSS score of CVE-2026-40322?

CVE-2026-40322 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Siyuan are affected by CVE-2026-40322?

SiYuan note-taking application versions 3.6.3 and below contain a CRITICAL remote code execution vulnerability affecting Electron desktop clients; publicly available exploit code exists but…

How to fix or mitigate CVE-2026-40322?

Within 24 hours, inventory SiYuan deployments and identify all systems running versions 3.6.3 or below, specifically mapping Electron desktop installations and documenting user populations. Within 7 days, implement interim controls: disable Mermaid diagram rendering in application settings if business function permits, or establish documented policy restricting document collaboration to verified internal sources and educate users not to click diagram elements in notes from external parties. Within 30 days, contact SiYuan vendor support to confirm patch availability and timeline; monitor official advisories for releases of version 3.6.4 or later and execute immediate upgrades upon patch release. If no vendor patch timeline emerges within 30 days, escalate to platform evaluation and prepare network isolation measures (air-gap SiYuan systems from sensitive data networks).

Siyuan CVE-2026-40322

CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-04-16 security-advisories@github.com

XSS RCE Microsoft Siyuan B3Log

9.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:14 vuln.today

Analysis Generated

Jul 24, 2026 - 07:14 vuln.today

CVE Published

Apr 16, 2026 - 23:16 nvd

CRITICAL 9.0

DescriptionGitHub Advisory

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, Mermaid diagrams are rendered with securityLevel set to "loose", and the resulting SVG is injected into the DOM via innerHTML. This allows attacker-controlled javascript: URLs in Mermaid code blocks to survive into the rendered output. On desktop builds using Electron, windows are created with nodeIntegration enabled and contextIsolation disabled, escalating the stored XSS to arbitrary code execution when a victim opens a note containing a malicious Mermaid block and clicks the rendered diagram node. This issue has been fixed in version 3.6.4.

AnalysisAI

Stored cross-site scripting escalating to remote code execution in SiYuan (b3log) versions 3.6.3 and below, where Mermaid diagrams render with securityLevel 'loose' and inject SVG via innerHTML, letting javascript: URLs in Mermaid code blocks survive into the DOM. On Electron desktop builds — created with nodeIntegration enabled and contextIsolation disabled — a victim opening a note with a malicious Mermaid block and clicking the diagram node triggers arbitrary code execution. Publicly available exploit code exists (SSVC 'poc'); not listed in CISA KEV, and EPSS is very low at 0.05%.