CVE Intelligence
Analysis AI-assisted

CVE-2026-54158: SiYuan: Stored XSS in Attribute View Cell Renderer

SiYuan versions before 3.7.0 render some attribute-view (database) cell values without escaping them, which allows stored cross-site scripting. The record states that on the Electron desktop client, where Node integration is enabled, this can extend to code execution on the host. The record identifies 3.7.0 as the fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SiYuan is an open-source personal knowledge management system. According to the advisory, versions before 3.7.0 insert raw content from several attribute-view cell types (text, url, phone and mAsset) into HTML, which enables stored cross-site scripting (CWE-79). Details are in the GitHub security advisory.

Impact

  • Stored XSS: malicious cell content persists in synced workspace data and runs when a user opens a block-attribute panel containing that row.
  • Desktop escalation: the advisory states that on the Electron desktop client, where the renderer runs with Node integration enabled, script execution can extend to code execution on the host.
  • Severity: the GitHub CNA rates the issue 9.9 (critical) under CVSS 3.1, with high confidentiality, integrity and availability impact and changed scope.

Affected products and versions

  • SiYuan versions prior to 3.7.0, according to the record.
  • The record contains no structured list of affected or fixed versions. The fixed version 3.7.0 comes from the description text.
  • The record does not state whether other SiYuan clients (web or mobile) are affected in the same way.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted. No EPSS data is available in the record.

Remediation and mitigation

  • Upgrade SiYuan to version 3.7.0 or later, as the advisory indicates.
  • Until the upgrade is applied, restrict write access to shared and synced workspaces, since the described attack path requires write access to a synced workspace.
  • Treat attribute-view content from untrusted collaborators with caution before opening related panels.
  • Follow vendor and Electron guidance on hardening desktop applications, including the Node integration setting.

Detection guidance

  • Review attribute-view data for cell values that contain HTML markup or event-handler attributes, especially in text, URL, phone and asset fields.
  • Monitor synced workspaces for unexpected changes to database rows made by unknown users or devices.
  • Review endpoint telemetry for unexpected child processes started by the SiYuan desktop application, as a high-level indicator of possible post-exploitation activity.

Limitations of the available information

The record contains no NVD score, no EPSS score, no structured product or version data, and no exploitation evidence. The English title was missing and was written from the description. Technical details beyond the cited advisory were not independently verified.

Frequently asked questions

Which SiYuan versions are affected by CVE-2026-54158?

According to the record, SiYuan versions prior to 3.7.0 are affected. The record does not provide a structured list of affected versions, so older releases should be checked against the advisory.

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted. The absence of data in those sources does not prove that exploitation has not occurred.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.