XSS Vulnerability in SiYuan Personal Knowledge Management System
CVE-2026-34585
What is CVE-2026-34585?
The SiYuan Personal Knowledge Management System contains a vulnerability that enables an attacker to exploit crafted block attribute values. Prior to the release of version 3.6.2, the system failed to adequately escape server-side attributes when HTML entities were mixed with raw special characters. This allows malicious users to embed harmful IAL values within .sy documents, which can then be packaged into a .sy.zip file. If a victim imports this file through the standard import process, opening the note can lead to an XSS attack. In the case of the Electron desktop client, this vulnerability can escalate to remote code execution, as the injected JavaScript gains access to Node/Electron APIs. This serious issue has been addressed in version 3.6.2.
Affected Version(s)
siyuan < 3.6.2