CVE-2026-54070 Overview
CVE-2026-54070 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in SiYuan, an open-source personal knowledge management system. Versions prior to 3.7.0 render third-party Bazaar package README files through the lute engine with an incomplete event-handler sanitizer. Modern DOM event attributes such as onpointerover, onpointerdown, onauxclick, onbeforetoggle, onfocusin, onanimationstart, and ontransitionend pass through the filter unchanged. When an administrator opens a package in Settings → Marketplace, the malicious HTML executes in the authenticated SiYuan origin. The vulnerability is fixed in version 3.7.0.
Critical Impact
A third-party Bazaar package author can execute JavaScript in the administrator's authenticated SiYuan origin and gain full control of the workspace without requiring package installation.
Affected Products
- SiYuan personal knowledge management system, all versions prior to 3.7.0
- The renderPackageREADME function in kernel/bazaar/readme.go
- The marketplace UI rendered through app/src/config/bazaar.ts
Discovery Timeline
- 2026-06-24 - CVE-2026-54070 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-54070
Vulnerability Analysis
The SiYuan kernel renders Bazaar package README content from Markdown to HTML using the lute engine with SetSanitize(true). The lute sanitizer relies on a blocklist named eventAttrs, which was copied from a legacy w3schools handler list. The allowAttr routine only rejects attribute names that appear in this static map.
The blocklist omits modern pointer, focus, animation, and transition event handlers. Attributes including onpointerover, onpointerdown, onauxclick, onbeforetoggle, onfocusin, onanimationstart, and ontransitionend are passed through verbatim on any tag. The rendered HTML is then assigned to mdElement.innerHTML in app/src/config/bazaar.ts with no client-side DOMPurify pass on this code path.
Root Cause
The vulnerability stems from a denylist-based sanitization strategy that was never updated to reflect the current HTML event-handler attribute surface. Compounding the issue, the SiYuan kernel emits no Content-Security-Policy, X-Frame-Options, or X-Content-Type-Options response headers. The README is rendered inside a normal element in the main document, with no iframe or sandbox isolation, so an inline handler runs immediately when its event fires.
Attack Vector
An attacker publishes a malicious package to the SiYuan Bazaar marketplace containing a crafted README. The README embeds an HTML element with one of the unfiltered event-handler attributes. When an administrator opens the package listing in Settings → Marketplace, after the one-time marketplace trust consent, the sanitizer permits the attribute. As soon as the administrator hovers, clicks, focuses, or otherwise interacts with the element, the attacker's JavaScript executes in the SiYuan origin. Installation of the package is not required. The script inherits the administrator's session and can perform any action the workspace API exposes.
Technical details are available in the GitHub Security Advisory GHSA-w7cg-whh7-xp28.
Detection Methods for CVE-2026-54070
Indicators of Compromise
- Bazaar packages whose README.md contains tags with onpointer*, onauxclick, onbeforetoggle, onfocusin, onanimationstart, or ontransitionend attributes
- Unexpected outbound HTTP requests from SiYuan to attacker-controlled domains following marketplace browsing activity
- Newly created or modified notebooks, documents, or workspace configuration files outside normal administrator activity
Detection Strategies
- Inspect rendered marketplace HTML for inline event-handler attributes that bypass the legacy eventAttrs blocklist
- Hash and review the README content of installed and previewed Bazaar packages against known-good sources
- Audit administrator browser sessions for script execution originating from the SiYuan origin while viewing marketplace pages
Monitoring Recommendations
- Log all administrator visits to Settings → Marketplace and correlate them with subsequent workspace API calls
- Monitor SiYuan kernel HTTP responses for the absence of Content-Security-Policy headers and enforce upstream proxy controls
- Alert on outbound network connections initiated by the SiYuan process to domains not on an approved allowlist
How to Mitigate CVE-2026-54070
Immediate Actions Required
- Upgrade all SiYuan installations to version 3.7.0 or later, which removes the vulnerable rendering path
- Restrict administrator access to Settings → Marketplace until patching is complete
- Revoke the one-time marketplace trust consent on any workspace that may have viewed untrusted packages
Patch Information
The issue is fixed in SiYuan 3.7.0. The fix is documented in the GitHub Security Advisory GHSA-w7cg-whh7-xp28. Administrators should verify the deployed binary reports version 3.7.0 or newer before re-enabling marketplace access.
Workarounds
- Avoid opening unfamiliar Bazaar packages in Settings → Marketplace on vulnerable versions
- Place a reverse proxy in front of SiYuan that injects a strict Content-Security-Policy header to block inline event handlers
- Run SiYuan in a dedicated browser profile with no other authenticated sessions to limit blast radius if exploitation occurs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
