Cross-Site Scripting Vulnerability in SiYuan Personal Knowledge Management System
CVE-2026-54158

9.9CRITICAL

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
24 June 2026

What is CVE-2026-54158?

SiYuan, a personal knowledge management system, is susceptible to a Cross-Site Scripting vulnerability that affects its attribute-view cell renderer. Prior to version 3.7.0, the renderer improperly interpolates certain cell contents such as phone numbers and URLs, enabling the execution of arbitrary JavaScript when a user opens the block-attribute panel. This vulnerability allows an attacker with write access to a synced workspace to inject a malicious payload that persists across all devices accessing the panel. The issue is amplified on Electron desktop due to node integration, allowing remote code execution via the require('child_process') function. This security flaw has been addressed in version 3.7.0.

Affected Version(s)

siyuan < 3.7.0

References

https://github.com/siyuan-note/siyuan/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.