EUVD-2026-330200

fkie_cve-2026-50551

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.

GHSA-56mp-4f3v-fgj2 — SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

Affected: Go: github.com/siyuan-note/siyuan/kernel

SiYuan v3.6.5 and earlier versions contain a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This is a neighbor-bug of CVE-2026-44588: the fix for -44588 used `escapeAriaLabel()` (double-escapes `<`), but the AV asset renderers were left using the weaker `escapeAttr()` (escapes only quotes) or no escaping at all.

## Vulnerability Details

The Electron renderer is configured with `nodeIntegration: true` and `contextIsolation: false` (app/electron/main.js:307), allowing any JavaScript executing in the renderer to directly access Node.js APIs including `require('child_process')`.

Two XSS sinks exist.

### Sink 1 (Direct Stored XSS - triggers on page load)

`app/src/protyle/render/av/cell.ts:1008`:

text += `<span class="b3-chip av__celltext--url ariaLabel" aria-label="${escapeAttr(item.content)}" data-name="${escapeAttr(item.name)}" data-url="${escapeAttr(item.content)}">${item.name || item.content}</span>`;

The `>${item.name || item.content}</span>` portion is raw user input with zero escaping.

`app/src/protyle/render/av/blockAttr.ts:93` (even worse - completely unescaped):

html += `<img loading="lazy" class="av__cellassetimg ariaLabel" aria-label="${item.content}" src="${getCompressURL(item.content)}">`;

Rendered via `action.ts:860`: `cellElement.innerHTML = renderCell(...)` results in immediate XSS on page load…

Most recent entries from all

EUVD-2026-330200

fkie_cve-2026-50551

GHSA-56mp-4f3v-fgj2 — SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content