CVE Intelligence
Analysis AI-assisted

CVE-2026-44670: SiYuan: Stored XSS in Attribute View names leading to Electron RCE

A stored cross-site scripting flaw in SiYuan's Attribute View names can inject HTML into connected clients. The advisory states that, because the Electron main window runs with Node integration enabled and context isolation disabled, this injection can lead to code execution. The record states the issue is fixed in version 3.7.0.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SiYuan is an open-source personal knowledge management system. According to the GitHub Security Advisory GHSA-2h64-c999-c9r6, the kernel stores Attribute View (database) names without HTML escaping, and those names are later embedded into HTML and pushed to all clients over WebSocket. Several client code paths render the value without escaping.

Impact

The advisory describes stored HTML injection in the renderer. Because the main Electron window is configured with Node integration enabled, context isolation disabled and web security disabled, the advisory states that this can become code execution in the Node.js context. The record's CVSS v4.0 vector assigns high impact to confidentiality, integrity and availability for the vulnerable system and subsequent systems, with a base score of 9.4 (critical). The CWE is CWE-79, Cross-site Scripting.

Affected products and versions

  • Product in the record: Siyuan-note Siyuan
  • Affected range in the record: versions before 3.7.0
  • The record's fixes field is empty; the fixed version 3.7.0 is stated in the advisory description.

Exploitation status

The KEV catalog does not list this CVE in the record consulted, so no confirmed active exploitation is reported. The record's SSVC field lists exploitation as 'poc' and automatable as 'no'. These labels do not confirm exploitation in the wild, and no confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade SiYuan to version 3.7.0 or later, as stated in the advisory.
  • Until upgrading, limit who can create or edit Attribute View names, especially in shared or collaborative workspaces.
  • Treat content from untrusted collaborators or imported workspaces as potentially hostile until the fixed version is deployed.
  • Review the NVD entry for updates to the record.

Detection guidance

  • Inventory all SiYuan clients and desktop installations to identify versions below 3.7.0.
  • Review Attribute View names for unusual markup or script-like content, particularly in shared workspaces.
  • Monitor endpoints running SiYuan for unexpected child processes or unusual network activity originating from the application.

Limitations of the available information

  • The record does not list the exact Electron, operating system or deployment configurations that are affected in practice.
  • The record does not confirm whether public proof-of-concept code exists beyond the SSVC label.
  • The record's fixes field is empty, so the fix details rely on the advisory description.
  • EPSS data in the record is a probability estimate and does not confirm exploitation.

Frequently asked questions

Is this SiYuan vulnerability being actively exploited?

The record shows this CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The SSVC label 'poc' does not by itself confirm exploitation in the wild.

Which version fixes CVE-2026-44670?

The advisory description states that the issue is fixed in SiYuan version 3.7.0. Versions before 3.7.0 are listed as affected in the record.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.