CVE-2026-54067: SiYuan Knowledge System RCE Vulnerability

CVE-2026-54067 Overview

CVE-2026-54067 is a stored cross-site scripting (XSS) vulnerability in SiYuan, an open-source personal knowledge management system. Versions prior to 3.7.0 fail to sanitize CSS snippet bodies before injecting them into the DOM via insertAdjacentHTML. A snippet containing </style> breaks out of the surrounding <style> tag and executes attacker-controlled JavaScript in the renderer process. On Electron desktop builds, the renderer runs with nodeIntegration:true, allowing the injected script to call require('child_process') and chain the XSS into host remote code execution (RCE). The flaw is tracked under CWE-79.

Critical Impact
Authenticated attackers with write access to a synced workspace can plant a single CSS snippet that executes arbitrary code on every desktop client pulling the workspace.

Affected Products

SiYuan personal knowledge management system, all versions prior to 3.7.0
SiYuan Electron desktop builds (Windows, macOS, Linux) running with nodeIntegration:true
Synced workspaces shared across multiple devices using SiYuan repository sync

Discovery Timeline

2026-06-24 - CVE-2026-54067 published to the National Vulnerability Database (NVD)
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54067

Vulnerability Analysis

The vulnerability resides in the renderSnippet() function, which interpolates user-supplied CSS snippet bodies into the page using insertAdjacentHTML. Because the content is rendered as HTML rather than treated as opaque CSS text, a snippet body containing a closing </style> tag terminates the wrapping <style> element. Any HTML that follows, including <script> blocks or event handlers, is parsed and executed by the renderer.

The issue is amplified by SiYuan's Electron architecture. The renderer process runs with Node.js integration enabled, so injected JavaScript can invoke Node APIs directly. An attacker can call require('child_process').exec() to spawn arbitrary operating system commands under the user's account.

Snippet objects are synchronized through the workspace repository. An attacker with write access to any synced workspace plants the malicious snippet once, and the payload fires on every device that subsequently pulls the workspace.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The renderSnippet() routine concatenates untrusted snippet content into an HTML string and passes it to insertAdjacentHTML, which performs full HTML parsing. CSS context is not preserved, so </style> terminates the style element prematurely.

The bug also bypasses SiYuan's enabledCSS and enabledJS separation. A user who disabled enabledJS made an explicit decision not to execute untrusted JavaScript, yet the CSS rendering path runs it regardless.

Attack Vector

The attack requires low privileges, write access to a synced workspace, and no user interaction beyond opening SiYuan. The attacker authors a CSS snippet whose body closes the <style> tag and follows it with an inline script tag or an event-handler-bearing element. When any client renders the snippet list, the script executes in the renderer. On Electron builds, the script obtains a handle to child_process and runs host commands. The vulnerability is fixed in SiYuan 3.7.0.

Detection Methods for CVE-2026-54067

Indicators of Compromise

CSS snippets stored in the workspace repository that contain the substring </style>, <script, or HTML event handlers such as onerror= and onload=
Unexpected child processes spawned by the SiYuan Electron process, including cmd.exe, powershell.exe, /bin/sh, or bash
Outbound network connections originating from the SiYuan renderer to attacker-controlled domains
Modifications to synced workspace snippet files (conf/snippets/*.css) by non-owner accounts

Detection Strategies

Inspect all CSS snippets in synced workspaces for HTML tag delimiters that should not appear in valid CSS
Hunt for process lineage where SiYuan or Electron is the parent of shell, scripting, or living-off-the-land binaries
Correlate workspace sync events with subsequent anomalous process execution on endpoints running SiYuan

Monitoring Recommendations

Enable endpoint detection and response (EDR) telemetry for process creation events tied to the SiYuan executable
Log and review Git or repository sync commits to SiYuan workspaces that modify snippet configuration files
Alert on Electron-based applications invoking child_process APIs to launch interpreters or networking utilities

How to Mitigate CVE-2026-54067

Immediate Actions Required

Upgrade all SiYuan desktop and server installations to version 3.7.0 or later
Audit synced workspaces for malicious CSS snippets and remove any containing HTML tags before redistributing
Rotate workspace repository credentials and revoke write access for untrusted collaborators
Treat any host that ran a vulnerable SiYuan build with shared snippets as potentially compromised and investigate for persistence

Patch Information

The maintainers fixed the vulnerability in SiYuan 3.7.0. Refer to the GitHub Security Advisory GHSA-mvjr-vv3c-w4qv for upstream details. The patch changes how snippet bodies are rendered so that CSS content is no longer interpolated as HTML.

Workarounds

Disable CSS snippets entirely until the upgrade is applied
Restrict write access on synced workspace repositories to a minimal set of trusted accounts
Do not pull or sync untrusted workspaces on Electron desktop clients running vulnerable versions
Run SiYuan inside a restricted user account or sandbox to limit the impact of renderer code execution

bash

# Verify the installed SiYuan version and upgrade if below 3.7.0
siyuan --version

# Audit synced workspace for suspicious snippet content
grep -RIn -E '</style>|<script|on[a-z]+=' /path/to/workspace/conf/snippets/