CVE Intelligence
Analysis AI-assisted

CVE-2026-54069: SiYuan Note: missing origin validation lets browser extensions gain admin API access

SiYuan Note versions before 3.7.0 trust every chrome-extension:// origin with administrator privileges on the local kernel HTTP server. According to the record, the default desktop installation has an empty access authorization code, so any installed Chrome or Chromium extension could reach the admin API. The record states the issue is fixed in 3.7.0 and gives it a CVSS 4.0 base score of 9.2.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SiYuan is an open-source personal knowledge management application. According to the record, its kernel HTTP server, in versions before 3.7.0, trusts every chrome-extension:// origin and grants those requests administrator-level access without authentication. The record classifies the weakness as CWE-346 (Origin Validation Error).

Impact

  • Any installed browser extension able to send requests to the local kernel could act with the administrator role, according to the record.
  • The record lists data exfiltration, stored cross-site scripting injection and configuration tampering as possible outcomes.
  • The record notes that a compromised legitimate extension, through a supply chain attack, is a possible route.
  • The CVSS 4.0 base score of 9.2 (critical) was assigned by the CNA, with high impact on confidentiality, integrity and availability and no privileges or user interaction required.

Affected products and versions

  • SiYuan Note, in versions prior to 3.7.0, as stated in the description.
  • The affected product list in the record is empty, so structured version ranges and platform details are not available.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. No EPSS data is present in the record.

Remediation and mitigation

  • Upgrade SiYuan Note to version 3.7.0 or later, which the record states contains the fix.
  • Review the browser extensions installed on systems running SiYuan Note and remove those that are unnecessary or not trusted.
  • Where the application allows it, set an access authorization code rather than relying on the empty default.
  • Keep browser extensions updated and limit installation to trusted sources.

Detection guidance

  • Inventory SiYuan Note installations and their versions on desktop endpoints.
  • Review the browser extension inventory on systems running affected versions for unexpected or recently changed extensions.
  • Watch for unexpected changes to SiYuan configuration or to note content, since the record associates the risk with configuration tampering and injected content.

Limitations of the available information

  • The record gives no structured list of affected versions beyond the phrase prior to 3.7.0, and no CWE name.
  • The record does not describe the specific requests, origin checks or extension behavior involved.
  • No EPSS score is available, and no exploitation evidence is provided in the sources consulted.
  • The record does not independently verify that the fix in 3.7.0 is complete.

Frequently asked questions

Is this vulnerability fixed?

The record states that the vulnerability is fixed in SiYuan Note 3.7.0. Upgrading to that version or later is the primary remediation.

Is this CVE known to be exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.