What is the CVSS score of CVE-2026-55570?

CVE-2026-55570 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of SiYuan are affected by CVE-2026-55570?

SiYuan personal knowledge management application versions before 3.7.0 enable remote code execution on employee desktops through malicious packages installed from the built-in marketplace, completely…. A patch is available.

How to fix or mitigate CVE-2026-55570?

24 hours: Locate all SiYuan installations (Program Files, /Applications, user directories); immediately disable marketplace features; scan event logs and installation history for any package installations in past 30 days. 7 days: Deploy SiYuan version 3.7.0 or later to all affected endpoints; verify installation via Help → About menu; audit all previously-installed marketplace packages for suspicious metadata or sources. 30 days: Configure endpoint detection and response (EDR) to alert when SiYuan process spawns child processes; integrate SiYuan into patch management tools for ongoing version compliance monitoring.

SiYuan CVE-2026-55570

EUVD-2026-39102 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 GitHub_M

XSS Command Injection Siyuan Siyuan Note

9.0

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Attacker must publish a marketplace package (PR:L) and victim must browse it (UI:R); renderer XSS escaping into OS command execution justifies S:C with full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 24, 2026 - 23:03 EUVD

Analysis Generated

Jun 24, 2026 - 22:21 vuln.today

DescriptionCVE.org

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape the untrusted fields (name, version, author, description) when they are serialized into the data-obj HTML attribute of each marketplace card. Because the attribute is single-quoted and the value is produced with JSON.stringify() (which does not escape ', <, or >), a package whose name contains a single quote breaks out of the attribute and injects arbitrary HTML. In the desktop client the main BrowserWindow runs with nodeIntegration: true, contextIsolation: false, so the injected markup escalates from DOM XSS to arbitrary OS command execution. This is the same root cause and same impact as the original advisory, reached through a sibling sink the patch did not cover. This vulnerability is fixed in 3.7.0.

AnalysisAI

Stored cross-site scripting leading to OS command execution in SiYuan, an open-source personal knowledge management system, affects all desktop client versions prior to 3.7.0. Untrusted marketplace package metadata (name, version, author, description) is serialized via JSON.stringify() into a single-quoted data-obj HTML attribute without escaping single quotes or angle brackets, so a package name containing a single quote breaks out of the attribute and injects arbitrary HTML; because the Electron BrowserWindow runs with nodeIntegration:true and contextIsolation:false, the DOM XSS escalates to arbitrary command execution on the host. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-x88j-wgpr-h22x) notes this is the same root cause and impact as a prior advisory, reached through a sibling sink the earlier patch missed.

Technical ContextAI

The vulnerability lives in SiYuan's marketplace UI, which renders package cards by embedding package metadata into a data-obj HTML attribute. The values are produced with JavaScript's JSON.stringify(), which correctly escapes characters like double-quotes and backslashes for JSON but does NOT escape the single-quote ('), less-than (<), or greater-than (>) characters that are significant in single-quoted HTML attribute contexts. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) where a JSON-encoding routine is incorrectly used as an HTML-attribute-encoding routine. The CPE cpe:2.3:a:siyuan-note:siyuan identifies the affected product. SiYuan's desktop client is built on Electron; with nodeIntegration:true and contextIsolation:false the renderer process has direct access to Node.js APIs (e.g. child_process), so any script injected into the DOM can invoke OS-level commands - the reason a content-injection bug becomes remote code execution rather than browser-confined XSS.

RemediationAI

Vendor-released patch: 3.7.0 - upgrade all SiYuan desktop clients to 3.7.0 or later, which adds proper escaping of the untrusted marketplace fields before they reach the data-obj attribute (see https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x88j-wgpr-h22x). Until upgrading, avoid opening or browsing the package marketplace within the desktop client, since the injection triggers when a malicious card is rendered; this trades away marketplace functionality but removes the trigger. As a deeper compensating control for environments that cannot patch immediately, run the client in a sandboxed/least-privilege OS account so that any resulting command execution is contained, accepting the inconvenience of restricted local privileges. Hardening the Electron configuration (contextIsolation:true / nodeIntegration:false) is the long-term structural mitigation but is not user-configurable in a packaged release and effectively requires the vendor fix.