CVE-2026-54069 Overview
CVE-2026-54069 affects SiYuan, an open-source personal knowledge management system. The kernel HTTP server in versions prior to 3.7.0 unconditionally trusts all chrome-extension:// origins. This trust grants RoleAdministrator access to every installed browser extension without authentication. Combined with the default empty AccessAuthCode on desktop installs, any Chromium-based extension can invoke admin API calls against the SiYuan kernel at 127.0.0.1:6806. A compromised legitimate extension introduced through a supply chain attack can exploit this trust boundary. The flaw is tracked under [CWE-346: Origin Validation Error] and is fixed in version 3.7.0.
Critical Impact
Any installed Chromium extension can issue authenticated administrator API calls to the SiYuan kernel, enabling data exfiltration, stored cross-site scripting (XSS) injection, and configuration tampering.
Affected Products
- SiYuan Note desktop application versions prior to 3.7.0
- SiYuan kernel HTTP server listening on 127.0.0.1:6806
- Desktop installations using the default empty AccessAuthCode
Discovery Timeline
- 2026-06-24 - CVE-2026-54069 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-54069
Vulnerability Analysis
SiYuan exposes a local kernel HTTP server on 127.0.0.1:6806 to support its desktop client and browser companion extension. The server inspects the Origin header on incoming requests to determine trust. Any request originating from a chrome-extension:// scheme is treated as fully privileged. The kernel automatically maps these requests to RoleAdministrator, bypassing the normal authentication path.
On desktop installs, the AccessAuthCode defaults to an empty value. This default removes the secondary authentication check that would otherwise protect admin endpoints. The combined behavior turns every Chromium extension on the host into an implicit administrator of the local SiYuan instance. Attackers can read notebook contents, write malicious HTML into stored notes, and modify kernel configuration. Stored XSS payloads can pivot inside the SiYuan client to extend control further.
Root Cause
The root cause is improper origin validation in the kernel's HTTP request handler. The server treats the chrome-extension:// scheme as an allow-listed trusted origin instead of requiring an explicit per-extension identifier or shared secret. The empty default AccessAuthCode removes the only remaining authentication gate.
Attack Vector
Exploitation requires a Chromium-based extension to be installed in any browser on the system running SiYuan. A malicious extension, or a legitimate extension compromised through a supply chain attack, sends fetch requests to http://127.0.0.1:6806 with appropriate API paths. The kernel honors the requests as administrator calls. No user interaction with SiYuan is required once the extension is active.
No verified public proof-of-concept code is published. See the GitHub Security Advisory for further technical context.
Detection Methods for CVE-2026-54069
Indicators of Compromise
- Unexpected HTTP requests to 127.0.0.1:6806 originating from browser processes with Origin headers starting with chrome-extension://.
- Unauthorized modifications to SiYuan notebook contents, including injected <script> tags or remote resource loads.
- Changes to SiYuan kernel configuration files or AccessAuthCode settings without administrator action.
Detection Strategies
- Monitor loopback traffic on TCP port 6806 and inspect request origins for any chrome-extension:// scheme values.
- Audit installed browser extensions across managed endpoints and compare against an approved allow-list.
- Review SiYuan kernel logs for administrator API calls that do not correlate with active user sessions in the desktop client.
Monitoring Recommendations
- Alert on outbound HTTP POST requests from browser processes targeting 127.0.0.1:6806 API paths.
- Track creation or modification of SiYuan data files outside of expected client activity windows.
- Correlate browser extension install or update events with subsequent local API traffic to SiYuan.
How to Mitigate CVE-2026-54069
Immediate Actions Required
- Upgrade SiYuan to version 3.7.0 or later on all desktop installations.
- Configure a strong, non-empty AccessAuthCode in SiYuan settings to enforce authentication on the kernel API.
- Audit installed Chromium extensions and remove any that are unverified or no longer required.
Patch Information
The vulnerability is fixed in SiYuan 3.7.0. The fix removes unconditional trust of chrome-extension:// origins in the kernel HTTP server. Refer to the SiYuan GitHub Security Advisory GHSA-hvr9-72v2-fff3 for upgrade guidance.
Workarounds
- Bind the SiYuan kernel to a non-default loopback address or restrict access via host firewall rules to block browser-originated requests until patched.
- Set a strong AccessAuthCode to require authentication for all kernel API calls.
- Use a dedicated browser profile without extensions when running SiYuan, eliminating untrusted chrome-extension:// origins.
# Configuration example: enforce AccessAuthCode and restrict loopback exposure
# 1. In SiYuan: Settings -> About -> Access authentication code -> set a strong value
# 2. Block external browser extensions from reaching the kernel (Linux iptables example)
sudo iptables -A OUTPUT -o lo -p tcp --dport 6806 -m owner ! --uid-owner siyuan -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
