SiYuan CVE-2026-54067

Exploitation requires the attacker to have write access to a workspace repository that the victim synchronizes, allowing them to plant or modify a CSS snippet; the malicious snippet body must contain a '</style>' break-out sequence followed by an event handler/script, which renderSnippet() then interpolates via insertAdjacentHTML. Full host RCE additionally requires the victim to be running an Electron desktop build where the renderer uses nodeIntegration:true (exposing require('child_process')); on non-Electron contexts impact is limited to in-renderer JavaScript execution. No victim user interaction is needed because the payload fires automatically when the device pulls the synced snippet, and the enabledJS=off protection does not limit it. Limiting factors: the attacker must hold write access to a synced workspace (PR:L, not anonymous internet access), and the maximum (RCE) impact depends on the Electron/nodeIntegration deployment mode.

Multiple signals point to genuine high priority rather than inflated CVSS. The vendor/NVD-style vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields 9.9: network-reachable, low complexity, only low privileges (write access to a synced workspace), no user interaction (the payload auto-executes on sync pull), and a scope change reflecting the renderer-to-host RCE escape with full confidentiality/integrity/availability loss. The UI:N and scope-change choices are well justified by the auto-firing sync delivery and the nodeIntegration RCE. Tempering factors: exploitation is not 'unauthenticated against the public internet' - it requires PR:L write access to a workspace the victim syncs, so realistic targets are shared/collaborative or compromised-sync scenarios. No EPSS score, POC, or KEV entry was provided, so there is no evidence of active or widespread exploitation; absence of these signals is not proof of safety but suggests this is currently a high-severity, not-yet-weaponized issue. The full-host RCE impact on Electron builds (versus script-only impact in a hypothetical sandboxed renderer) is the dominant risk driver.

An attacker who gains write access to a workspace the victim syncs (for example a shared/collaborative repo or a previously compromised sync endpoint) saves a CSS snippet whose body contains '</style>' followed by a JavaScript handler that calls require('child_process').exec(...). When any paired device pulls the synced workspace, renderSnippet() interpolates the snippet via insertAdjacentHTML, the handler executes in the nodeIntegration-enabled renderer, and the attacker obtains code execution on the victim's host with no user interaction. No public POC was provided, but the low attack complexity makes reliable exploitation straightforward.