CVE-2026-44586
HIGH EPSS 22.3%
Published May 14, 20261mo ago · Modified Jun 17, 20262w ago
8.3 CVSS 3.1
Published May 14, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago
Description
SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan's Bazaar marketplace renders package author metadata from the public bazaar stage feed into HTML without escaping. In the desktop app this becomes stored XSS, and because SiYuan's Electron windows are created with nodeIntegration: true and contextIsolation: false, a successful payload can call Node.js APIs and execute code on the host. This vulnerability is fixed in 3.7.0.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
22.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 2
CWE-79 Cross-site Scripting Injection
CWE-94 Improper Control of Generation of Code (Code Injection) Injection
References 1
- github.com https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x6wf-w2rg-2gw9
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.