HTML Injection Vulnerability in SiYuan Personal Knowledge Management System by SiYuan
CVE-2026-44670

9.4CRITICAL

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
14 May 2026

What is CVE-2026-44670?

SiYuan, an open-source personal knowledge management system, harbors a vulnerability that allows HTML injection due to improper handling of Attribute View (AV) names. Prior to version 3.7.0, AV names were stored without HTML escaping, leading to potential code execution when these names were rendered in client paths without safeguards. Specifically, because the application runs with nodeIntegration enabled and lacks context isolation and web security, attackers could exploit this flaw to execute arbitrary Node.js code via malicious input. This critical issue was addressed in version 3.7.0.

Affected Version(s)

siyuan < 3.7.0

References

https://github.com/siyuan-note/siyuan/security/advisories...
x_refsource_CONFIRM

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.