SiYuan CVE-2026-54069

Requires a Chrome/Chromium browser extension (malicious, or legitimate-but-compromised via supply chain) installed in a browser on the same host where SiYuan's kernel is running and reachable at 127.0.0.1:6806, with SiYuan version prior to 3.7.0. Exploitation is trivial against desktop installs because AccessAuthCode is empty by default; setting a non-empty AccessAuthCode is the main limiting factor. Other limiting factors: the attacker must already have an extension present in the victim's browser (no purely remote, no-foothold exploitation), and the kernel must be running and accessible to the browser. No interaction with the SiYuan UI and no SiYuan-specific credentials are needed once those conditions hold.

The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.2) reflects full confidentiality/integrity/availability impact to the SiYuan instance with no authentication, but a high attack complexity (AC:H) that captures the real precondition: the attacker must control a browser extension already installed in the victim's browser. Publicly available exploit code raises practical risk, but this is not listed in CISA KEV and no EPSS score was provided, so widespread automated exploitation cannot be asserted. The AV:N rating is debatable - the kernel binds to localhost (127.0.0.1) and the malicious extension runs on the victim's own machine, which is closer to a local/adjacent context; the network exposure is really 'any installed extension' rather than 'any remote host'. Net assessment: a genuinely serious flaw for affected SiYuan users (admin takeover of all notes via a single rogue extension), but its blast radius is bounded by the browser-extension prerequisite and the moderate deployment footprint of the product, so it is high-priority for SiYuan operators specifically rather than a broad internet-wide emergency.

An attacker publishes or compromises (via supply chain) a Chrome extension that the victim already trusts and has installed. When the victim is running SiYuan, the extension silently issues fetch requests to http://127.0.0.1:6806 with its chrome-extension:// origin; the kernel grants administrator rights and the extension reads all notes, alters configuration, or injects stored XSS. Publicly available exploit code demonstrates the admin API access, and no user interaction with SiYuan itself is required once the extension is present.