Stored Cross-Site Scripting Vulnerability in SiYuan Personal Knowledge Management System
CVE-2026-50551

9.9CRITICAL

Key Information:

Vendor: Siyuan-note
Status: Siyuan
Vendor: CVE Published:; 24 June 2026

🔔 Create Siyuan-note Vulnerability Alert

What is CVE-2026-50551?

The SiYuan Personal Knowledge Management System is susceptible to a stored cross-site scripting (XSS) vulnerability in the Attribute View asset cell renderer. This flaw allows attackers to inject malicious scripts, which can escalate to remote code execution (RCE) when exploited on the Electron desktop client. It is advisable for users to upgrade to version 3.7.0 or later, where this vulnerability has been addressed.

Affected Version(s)

siyuan < 3.7.0

References

https://github.com/siyuan-note/siyuan/security/advisories...

x_refsource_CONFIRM

CVSS V3.1

Score:

9.9

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 24, 2026
Vulnerability Reserved
Jun 4, 2026

CVE-2026-50551 Data

JSON