CVE Intelligence
Analysis AI-assisted

CVE-2026-50551: SiYuan: stored XSS in Attribute View asset cells escalating to RCE in Electron client

SiYuan, an open-source personal knowledge management system, is affected by a stored cross-site scripting flaw in the asset cell renderer of its Attribute View (database) feature. According to the record, the flaw can escalate to remote code execution in the Electron desktop client, and it is fixed in version 3.7.0. The GitHub CNA reports a CVSS 3.1 score of 9.9 (critical).

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SiYuan is an open-source personal knowledge management system. The advisory describes a stored cross-site scripting (XSS) flaw in the renderer for asset cells within the Attribute View (database) feature. The record states that the flaw can escalate to remote code execution (RCE) in the Electron desktop client and that it is fixed in version 3.7.0.

Impact

  • Stored XSS means that attacker-controlled content saved in the application may run in the context of the application when a user views the affected data.
  • The record states that this can escalate to RCE in the Electron desktop client.
  • The GitHub CNA assigns a CVSS 3.1 base score of 9.9 (critical). The vector in the record indicates network attack vector, low complexity, low privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity and availability.

Affected products and versions

  • The description states that the issue affects SiYuan prior to version 3.7.0.
  • The structured affected-products list in the record is empty, so the exact affected ranges and platforms are unknown beyond the description. Consult the GitHub security advisory for details.
  • The description states the fix is in version 3.7.0.

Exploitation status

  • The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog in the record.
  • No confirmed exploitation appears in the sources consulted.
  • No EPSS score is available in the record.

Remediation and mitigation

  • Update SiYuan, including the Electron desktop client, to version 3.7.0 or later.
  • Until the update is applied, be cautious about opening Attribute View databases or importing content from untrusted sources, since the flaw involves stored content.
  • Limit access to shared SiYuan workspaces to trusted users where practical.

Detection guidance

  • Review Attribute View databases and asset cells for unexpected or unfamiliar content, especially content contributed by users outside the trusted group.
  • Monitor endpoints running the SiYuan desktop client for unusual child processes or behavior originating from the application, which could indicate code execution after exploitation.
  • Keep application and endpoint logs available to support investigation if a compromise is suspected.

Limitations of the available information

  • The record does not include structured affected or fixed version lists, so only the description's statements about versions are available.
  • The record does not include technical details of the vulnerable code path, exploitation conditions or proof-of-concept status, and this analysis does not provide them.
  • No EPSS, SSVC or KEV data is present in the record.
  • The only advisory reference in the record is the GitHub security advisory; the NVD and CVE.org pages are listed as source pages without additional detail beyond the record.

Frequently asked questions

Is CVE-2026-50551 being actively exploited?

The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted. Monitor official sources for changes.

Which SiYuan version fixes this issue?

The description states that the vulnerability is fixed in SiYuan 3.7.0, and that versions prior to 3.7.0 are affected.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.