https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T22:32:43.508270+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-330200 EUVD-2026-330200 2026-10-19T22:32:43.510564+00:00 EUVD-2026-330200 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50551 fkie_cve-2026-50551 2026-10-19T22:32:43.510597+00:00

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.

 https://cve.radiocsirt.org/vuln/ghsa-56mp-4f3v-fgj2 GHSA-56mp-4f3v-fgj2 — SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content 2026-10-19T22:32:43.510629+00:00

Affected: Go: github.com/siyuan-note/siyuan/kernel

SiYuan v3.6.5 and earlier versions contain a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This is a neighbor-bug of CVE-2026-44588: the fix for -44588 used `escapeAriaLabel()` (double-escapes `<`), but the AV asset renderers were left using the weaker `escapeAttr()` (escapes only quotes) or no escaping at all.

## Vulnerability Details

The Electron renderer is configured with `nodeIntegration: true` and `contextIsolation: false` (app/electron/main.js:307), allowing any JavaScript executing in the renderer to directly access Node.js APIs including `require('child_process')`.

Two XSS sinks exist.

### Sink 1 (Direct Stored XSS - triggers on page load)

`app/src/protyle/render/av/cell.ts:1008`:

text += `<span class="b3-chip av__celltext--url ariaLabel" aria-label="${escapeAttr(item.content)}" data-name="${escapeAttr(item.name)}" data-url="${escapeAttr(item.content)}">${item.name || item.content}</span>`;

The `>${item.name || item.content}</span>` portion is raw user input with zero escaping.

`app/src/protyle/render/av/blockAttr.ts:93` (even worse - completely unescaped):

html += `<img loading="lazy" class="av__cellassetimg ariaLabel" aria-label="${item.content}" src="${getCompressURL(item.content)}">`;

Rendered via `action.ts:860`: `cellElement.innerHTML = renderCell(...)` results in immediate XSS on page load…