CVE Intelligence
Analysis AI-assisted

CVE-2026-55570: SiYuan: XSS in marketplace cards enabling OS command execution in desktop client

CVE-2026-55570 affects SiYuan versions prior to 3.7.0, where untrusted package fields are not escaped in marketplace card markup. In the desktop client this DOM XSS can escalate to arbitrary OS command execution, and the record rates it critical with CVSS 3.1 score 9. Upgrading to 3.7.0 or later is the primary remediation, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SiYuan is an open-source personal knowledge management system. According to the record, versions before 3.7.0 do not escape fields such as name, version, author and description when building marketplace card markup, so package metadata can break out of an HTML attribute. The record classifies the weakness as CWE-79 (Cross-site Scripting). The advisory is GHSA-x88j-wgpr-h22x.

Impact

  • Cross-site scripting in the marketplace interface, which runs inside the application.
  • According to the record, in the desktop client the injected markup can escalate to arbitrary operating system command execution because of the renderer configuration.
  • The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H rates confidentiality, integrity and availability impact as high, with changed scope and required user interaction.

Affected products and versions

  • Product: SiYuan (siyuan-note/siyuan), as referenced by the advisory URL.
  • Versions: the description states versions prior to 3.7.0. The structured affected list in the record is empty, so the exact range should be confirmed in the advisory.

Exploitation status

The record lists this CVE as not present in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record.

Remediation and mitigation

  • Upgrade SiYuan to version 3.7.0 or later, which the description identifies as the fixed version.
  • Until the upgrade is applied, limit exposure of the desktop client to untrusted marketplace packages and avoid installing packages from unknown sources.
  • Review the advisory for any additional measures provided by the maintainers.

Detection guidance

  • Inventory SiYuan desktop installations and record their versions.
  • Review marketplace packages installed on endpoints, paying attention to unexpected or unverified names and metadata.
  • Monitor for unexpected child processes started by the SiYuan application as a high-level indicator of abuse.

Limitations of the available information

  • The record has empty affected and fixes lists; the fixed version comes from the description text.
  • The original advisory mentioned in the description is not identified by URL in the record.
  • No EPSS or SSVC data is present in the record, and exploitation status is unknown beyond the sources consulted.

Frequently asked questions

Which SiYuan versions are affected by CVE-2026-55570?

The description states that versions prior to 3.7.0 are affected. The structured affected list in the record is empty, so the exact range should be confirmed in the GitHub advisory.

Is CVE-2026-55570 being actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. Organizations should still treat it as high priority given its critical CVSS score.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.