HTML Sanitization Flaw in SiYuan Knowledge Management Software
CVE-2026-54759

8.7HIGH

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
24 June 2026

What is CVE-2026-54759?

An HTML sanitization flaw in the SiYuan personal knowledge management system allows attackers to inject malicious elements in Bazaar package READMEs. This vulnerability lets a crafted README execute arbitrary commands on a user's machine when viewed, without needing to install any packages. This issue arises from the combination of the inadequate sanitization process in Lute before version 3.7.0 and the lenient security settings of the SiYuan Electron client. The vulnerability has been addressed in version 3.7.0, ensuring safe handling of HTML content in packages.

Affected Version(s)

siyuan < 3.7.0

References

https://github.com/siyuan-note/siyuan/security/advisories...
x_refsource_CONFIRM

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.