CVE-2026-54158

Full vulnerability record from the local CVENow database.

Description

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (database) cell renderer genAVValueHTML interpolates cell content raw in four of its branches: text, url, phone, and mAsset. A cell value like </textarea><img src=x onerror="..."> or "><img src=x onerror="..."> breaks out of its surrounding tag and runs arbitrary JavaScript in the renderer when the victim opens the block-attribute panel. On Electron desktop the renderer runs with nodeIntegration:true, so the XSS chains to host RCE via require('child_process'). AV files live under the workspace and ride normal sync, so an attacker with write access to any synced workspace plants the payload once and it fires on every device that opens a panel containing that row.he kernel doesn't escape on the way in either, so the malicious cell persists byte-for-byte. There's no equivalent of the html.EscapeAttrVal call that protects block IAL attributes at kernel/model/blockial.go:261. This vulnerability is fixed in 3.7.0.

Severity

CRITICAL

CVSS score

9.9 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-06-24 22:16:48.740000

Last modified

2026-10-25 23:10:00.167000

View original CVE JSON

{
  "id": "CVE-2026-54158",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-24T22:16:48.740",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (database) cell renderer genAVValueHTML interpolates cell content raw in four of its branches: text, url, phone, and mAsset. A cell value like </textarea><img src=x onerror=\"...\"> or \"><img src=x onerror=\"...\"> breaks out of its surrounding tag and runs arbitrary JavaScript in the renderer when the victim opens the block-attribute panel. On Electron desktop the renderer runs with nodeIntegration:true, so the XSS chains to host RCE via require('child_process'). AV files live under the workspace and ride normal sync, so an attacker with write access to any synced workspace plants the payload once and it fires on every device that opens a panel containing that row.he kernel doesn't escape on the way in either, so the malicious cell persists byte-for-byte. There's no equivalent of the html.EscapeAttrVal call that protects block IAL attributes at kernel/model/blockial.go:261. This vulnerability is fixed in 3.7.0."
    },
    {
      "lang": "es",
      "value": "SiYuan es un sistema de gestión de conocimiento personal de código abierto. Antes de la versión 3.7.0, el renderizador de celdas genAVValueHTML de la vista de atributos (base de datos) interpola el contenido de la celda en bruto en cuatro de sus ramas: texto, url, teléfono y mAsset. Un valor de celda como </textarea [tag_HTML_PoC]  o ’ [tag_HTML_PoC] ’ escapa de su etiqueta circundante y ejecuta JavaScript arbitrario en el renderizador cuando la víctima abre el panel de atributos de bloque. En el escritorio de Electron, el renderizador se ejecuta con nodeIntegration:true, por lo que el XSS se encadena a RCE en el host a través de require(’child_process’). Los archivos AV residen en el espacio de trabajo y se sincronizan normalmente, por lo que un atacante con acceso de escritura a cualquier espacio de trabajo sincronizado implanta la carga útil una vez y se activa en cada dispositivo que abre un panel que contiene esa fila. El kernel tampoco escapa al entrar, por lo que la celda maliciosa persiste byte a byte. No existe un equivalente de la llamada html.EscapeAttrVal que protege los atributos IAL de bloque en kernel/model/blockial.go:261. Esta vulnerabilidad está corregida en la versión 3.7.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "siyuan-note",
          "product": "siyuan",
          "versions": [
            {
              "version": "< 3.7.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-25T23:11:44.806060Z",
          "id": "CVE-2026-54158",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5xfx-xj4h-5p7r",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5xfx-xj4h-5p7r",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}