EUVD-2026-39128
GHSA-56mp-4f3v-fgj2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attacker needs low-privilege write access to store the payload (PR:L) and a victim must open the malicious database view (UI:R); RCE escaping the app sandbox to the OS justifies S:C and C/I/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.
AnalysisAI
Stored cross-site scripting in SiYuan's Attribute View (database) asset cell renderer escalates to remote code execution on the Electron desktop client for all versions prior to 3.7.0. An attacker who can persist crafted content into a database asset cell has malicious JavaScript executed in the privileged Electron context, breaking out to the host operating system; the issue carries a 9.9 CVSS and is fixed in 3.7.0. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Technical ContextAI
SiYuan is an open-source local-first personal knowledge management application distributed both as a web service and as a cross-platform Electron desktop client. The root cause is CWE-79 (improper neutralization of input during web page generation): the renderer that displays asset cells inside an Attribute View 'database' block fails to sanitize or encode attacker-controlled markup before injecting it into the DOM. Because the desktop client is built on Electron - which embeds Chromium with access to Node.js/native APIs unless strictly sandboxed - a stored script injection that would be a contained XSS in a browser instead gains the ability to invoke system-level primitives, turning the XSS into full remote code execution. The single affected product is identified by CPE cpe:2.3:a:siyuan-note:siyuan with all versions below the 3.7.0 fix.
RemediationAI
Vendor-released patch: 3.7.0 - upgrade all SiYuan installations (desktop and server) to 3.7.0 or later, which fixes the asset cell renderer sanitization, per advisory GHSA-56mp-4f3v-fgj2 (https://github.com/siyuan-note/siyuan/security/advisories/GHSA-56mp-4f3v-fgj2). If immediate upgrade is not possible, avoid importing or opening untrusted notebooks, workspaces, or shared databases that could contain crafted asset cells, and restrict who can write to shared/synced workspaces (trade-off: limits collaboration and shared-content workflows). On the desktop client, treating the Electron app as an untrusted-content viewer and not opening third-party-supplied workspace data reduces the RCE escalation path until patched. There is no documented in-product toggle to disable the Attribute View renderer, so patching is the only complete fix.
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), t
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. R
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated criti
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated c
SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code ex
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chro
Reflected XSS in SiYuan knowledge management before 3.5.9.
SiYuan knowledge management system prior to 3.5.5 has a path traversal in /api/file/copyFile allowing arbitrary file ope
SiYuan version 3.0.3 allows executing arbitrary commands on the server. Rated critical severity (CVSS 9.0), this vulnera
SQL injection in SiYuan prior to version 3.6.0 allows any authenticated user, including those with read-only access, to
Cross-site scripting (XSS) in SiYuan personal knowledge management system versions 3.6.0-3.6.1 allows remote attackers t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today