EUVD-2026-17676
GHSA-68p4-j234-43mv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (Access-Control-Allow-Origin: * + Access-Control-Allow-Private-Network: true) to inject a JavaScript snippet via the API. The injected snippet executes in Electron's Node.js context with full OS access the next time the user opens SiYuan's UI. No user interaction is required beyond visiting the malicious website while SiYuan is running. This issue has been patched in version 3.6.2.
AnalysisAI
Remote code execution in SiYuan desktop application (versions prior to 3.6.2) allows unauthenticated remote attackers to execute arbitrary code with full operating system privileges through CORS misconfiguration. A malicious website can inject JavaScript into the Electron-based application's Node.js context via the permissive API (Access-Control-Allow-Origin: * with Access-Control-Allow-Private-Network: true), which executes with OS-level access when the user next opens SiYuan's interface. No public exploit identified at time of analysis, though CVSS 9.6 (Critical) reflects network-accessible attack vector with low complexity requiring only user interaction (visiting malicious site while SiYuan runs). EPSS data not provided, but the combination of Electron framework exploitation, RCE impact, and trivial attack complexity suggests elevated real-world risk for desktop users.
Technical ContextAI
SiYuan is an Electron-based personal knowledge management system that embeds a local API server. The vulnerability stems from CWE-942 (Overly Permissive Cross-Origin Resource Sharing), where the application's API endpoints expose wildcard CORS headers (Access-Control-Allow-Origin: *) combined with Access-Control-Allow-Private-Network: true. This configuration allows any website origin to make authenticated requests to SiYuan's localhost API. In Electron applications, JavaScript executed within the renderer process can access Node.js APIs if nodeIntegration is enabled or context isolation is improperly configured. The attack chain involves: (1) victim visits attacker-controlled website while SiYuan runs, (2) malicious JavaScript uses permissive CORS to inject payloads via SiYuan's API, (3) injected code persists and executes in Electron's privileged Node.js context on next UI launch, granting full filesystem and process execution capabilities. This represents a critical architectural flaw in Electron security boundaries where web content can bridge into native OS access.
RemediationAI
Upgrade immediately to SiYuan version 3.6.2 or later, released February 2025, which patches the permissive CORS configuration. The vendor-released patch is available at https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2 and addresses the API security boundary by restricting cross-origin access. Users should verify the installed version and apply updates through the application's built-in update mechanism or by downloading the patched release directly from the GitHub releases page. No workarounds are documented; upgrading is the only confirmed remediation. After upgrading, review any custom plugins or scripts for similar CORS misconfigurations. Organizations deploying SiYuan should audit endpoint exposure and consider network segmentation to limit localhost API accessibility. Refer to the security advisory at https://github.com/siyuan-note/siyuan/security/advisories/GHSA-68p4-j234-43mv for additional technical details.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today