Remote Code Execution Vulnerability in SiYuan Knowledge Management System

CVE-2026-39846

What is CVE-2026-39846?

The SiYuan personal knowledge management system is susceptible to a vulnerability that could allow remote code execution. Prior to the 3.6.4 update, attackers could exploit this flaw by creating a malicious note that, when synced to a victim's workspace, would execute arbitrary JavaScript in the SiYuan Electron desktop client. This occurs due to inadequate escaping of table caption content, leading to a stored XSS vulnerability. The vulnerable setup permits access to Node.js APIs since the desktop renderer runs with nodeIntegration enabled and contextIsolation disabled. The exploitation sequence involves the attacker importing a crafted note, followed by the victim syncing and opening the note, which triggers code execution. The vulnerability has been addressed in version 3.6.4.

References