What is the CVSS score of CVE-2026-44586?

CVE-2026-44586 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of SiYuan are affected by CVE-2026-44586?

SiYuan Bazaar marketplace contains a stored cross-site scripting vulnerability (CVE-2026-44586, CVSS 8.3) in versions 2.1.12 through 3.6.x that could allow attackers to execute arbitrary code on…. A patch is available.

How to fix or mitigate CVE-2026-44586?

Within 24 hours: Inventory all SiYuan installations across the organization and document versions in use; disable or restrict access to the Bazaar marketplace feature pending remediation. Within 7 days: Contact SiYuan vendor for patch timeline and interim guidance; implement network segmentation to limit SiYuan process capabilities if applicable. Within 30 days: Apply vendor-released patch immediately upon availability; conduct audit of installed packages from Bazaar marketplace for suspicious metadata or authors.

SiYuan CVE-2026-44586

EUVD-2026-30354 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-14 GitHub_M

XSS Microsoft Node.js

8.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 14, 2026 - 20:17 EUVD

Analysis Generated

May 14, 2026 - 19:30 vuln.today

CVE Published

May 14, 2026 - 18:11 nvd

HIGH 8.3

DescriptionGitHub Advisory

SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan's Bazaar marketplace renders package author metadata from the public bazaar stage feed into HTML without escaping. In the desktop app this becomes stored XSS, and because SiYuan's Electron windows are created with nodeIntegration: true and contextIsolation: false, a successful payload can call Node.js APIs and execute code on the host. This vulnerability is fixed in 3.7.0.

AnalysisAI

Stored cross-site scripting in SiYuan's Bazaar marketplace (versions 2.1.12 through 3.6.x) enables arbitrary code execution on the host system. The vulnerability stems from unescaped package author metadata rendering, which when exploited through a malicious marketplace package, allows attackers to leverage SiYuan's insecure Electron configuration (nodeIntegration enabled, contextIsolation disabled) to execute Node.js APIs and OS-level commands. No public exploit or active exploitation confirmed at time of analysis. CVSS 8.3 with high attack complexity and required user interaction suggests real-world exploitation depends on convincing users to view crafted marketplace entries.

Technical ContextAI

SiYuan is an open-source personal knowledge management system built on Electron framework. The vulnerability exists in the Bazaar marketplace component, which fetches package metadata from a public feed and renders author information into the application's HTML interface. The affected product (cpe:2.3:a:siyuan-note:siyuan) runs as an Electron desktop application configured with nodeIntegration: true and contextIsolation: false - security settings that expose Node.js APIs to web content. CWE-79 (Cross-site Scripting) in this context escalates beyond typical XSS impact because the Electron security model is intentionally weakened, allowing JavaScript payloads to break out of the browser sandbox and execute system commands via require() calls to Node.js modules like child_process. This architectural decision transforms what would normally be a data exfiltration risk into a complete system compromise vector.

RemediationAI

Upgrade to SiYuan 3.7.0 or later, which implements proper HTML escaping for Bazaar marketplace metadata rendering. Download the patched release from the official SiYuan GitHub repository releases page. If immediate upgrade is not feasible, disable or restrict access to the Bazaar marketplace feature within SiYuan settings to prevent exposure to malicious package metadata. Review and remove any custom or third-party Bazaar feed URLs configured in the application, retaining only the official siyuan-note marketplace source. Organizations should audit systems for indicators of compromise by reviewing SiYuan application logs and system process execution history for unexpected Node.js child process spawns. Note that disabling Bazaar access impacts the user's ability to install community plugins and themes, creating a usability trade-off until upgrade is completed. Full remediation details at https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x6wf-w2rg-2gw9.