Cross-Site Scripting in SiYuan Personal Knowledge Management System

CVE-2026-41421

What is CVE-2026-41421?

SiYuan, an open-source personal knowledge management system, is susceptible to a Cross-Site Scripting (XSS) flaw due to improper handling of notification messages in versions before 3.6.5. Specifically, the application renders raw HTML from user-controlled input when displaying notifications. This implementation flaw, combined with the Electron framework's lack of security configurations—allowing node integration and disabling context isolation—can lead to severe security implications. An attacker can exploit this weakness to execute arbitrary JavaScript code, gaining unauthorized access to Node APIs and potentially escalating privileges to execute code on the desktop environment.

References