CVE Intelligence
Analysis AI-assisted

CVE-2026-54067: SiYuan CSS snippet XSS leading to Electron renderer code execution

SiYuan versions prior to 3.7.0 mishandle CSS snippet content, which can break out of its style container and run JavaScript in the renderer. The advisory states that on Electron desktop builds this can extend to host code execution, and that synced snippets can affect other devices. The advisory states the issue is fixed in 3.7.0.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SiYuan is an open-source personal knowledge management system. According to the advisory, versions before 3.7.0 let CSS snippet content that includes a closing style tag escape its container when the renderer inserts it into the page, so script can run in the application renderer. See the GitHub Security Advisory.

Impact

  • Script execution in the SiYuan renderer context.
  • The advisory states that on Electron desktop builds the renderer runs with node integration enabled, and that this can chain to code execution on the host.
  • Snippets synced through a workspace repository can propagate the content to other devices that pull the workspace, according to the advisory.
  • The advisory states the flaw bypasses the separation between CSS and JavaScript snippet settings, so content can run even when JavaScript snippets are disabled.
  • The record scores the issue at 9.9 (critical) under CVSS 3.1 with high confidentiality, integrity and availability impact.

Affected products and versions

  • Product: SiYuan (siyuan-note/siyuan).
  • Affected: versions prior to 3.7.0, as stated in the description.
  • The record does not provide structured affected version ranges.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed active exploitation or exploited in the wild status appears in the sources consulted. No public exploit details are included in the record.

Remediation and mitigation

  • Upgrade SiYuan to version 3.7.0 or later, which the description identifies as the fixed version.
  • Until the upgrade is complete, restrict write access to synced workspace repositories to trusted users only.
  • Review shared workspaces and their CSS snippets for unexpected markup before using them, and disable snippet sync for workspaces where this is not needed.
  • Keep JavaScript and CSS snippet features under review in environments where users handle untrusted content.

Detection guidance

  • Review workspace repositories for recent changes to CSS snippets that contain unexpected markup or script-related content.
  • Watch for unusual child processes started by the SiYuan desktop application, as a high-level indicator of host compromise.
  • Confirm the installed version on every device that syncs the workspace.

Limitations of the available information

  • The record has no structured affected or fixed version data, so the fixed version comes only from the description text.
  • The record does not include independent technical verification of the exploit chain; the chain is as described by the advisory.
  • EPSS and SSVC values are missing, so exploitation likelihood is unknown.
  • The record does not state whether any patch releases other than 3.7.0 exist, or whether backports are available.

Frequently asked questions

Which SiYuan versions are affected?

The description states that versions prior to 3.7.0 are affected. The record does not provide a structured list of affected ranges.

Is this vulnerability known to be exploited in the wild?

The record shows this CVE is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.

What should administrators do?

Upgrade SiYuan to version 3.7.0 or later and limit write access to synced workspace repositories to trusted users until the upgrade is complete.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.