Remote Code Execution Vulnerability in SiYuan by SiYuan Note
CVE-2026-34449

9.7CRITICAL

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
31 March 2026

What is CVE-2026-34449?

SiYuan, a personal knowledge management system, is vulnerable to remote code execution due to a permissive CORS policy prior to version 3.6.2. Attackers can exploit this vulnerability by injecting malicious JavaScript through the API from a compromised website. When a user with SiYuan open the application after visiting the malicious site, the executed code runs within Electron’s Node.js context, granting the attacker full access to the operating system. This vulnerability does not require any user interaction beyond visiting the malicious site while SiYuan is active. The issue has been addressed in version 3.6.2.

Affected Version(s)

siyuan < 3.6.2

References

https://github.com/siyuan-note/siyuan/security/advisories...
x_refsource_CONFIRM
https://github.com/siyuan-note/siyuan/issues/17246
x_refsource_MISC
https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2
x_refsource_MISC

CVSS V3.1

Score:
9.7
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.