CVE-2026-54158: SiYuan Knowledge Management RCE Flaw

CVE-2026-54158 Overview

CVE-2026-54158 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in SiYuan, an open-source personal knowledge management system. The flaw resides in the attribute-view (database) cell renderer genAVValueHTML, which interpolates raw cell content in four branches: text, url, phone, and mAsset. An attacker with write access to a synced workspace can plant a payload that executes JavaScript when any victim opens the block-attribute panel. On Electron desktop builds, the renderer runs with nodeIntegration:true, allowing the XSS to chain into host Remote Code Execution (RCE) via require('child_process'). The vulnerability is fixed in version 3.7.0.

Critical Impact
Stored XSS in synced attribute-view cells escalates to host RCE on Electron desktop clients across every device opening the affected panel.

Affected Products

SiYuan personal knowledge management system prior to 3.7.0
SiYuan Electron desktop builds (Windows, macOS, Linux) with nodeIntegration:true
Synced SiYuan workspaces shared across multiple devices

Discovery Timeline

2026-06-24 - CVE-2026-54158 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54158

Vulnerability Analysis

The vulnerability stems from unsanitized HTML interpolation in the genAVValueHTML cell renderer. SiYuan stores attribute-view (AV) database content under the workspace directory and synchronizes it across devices. When a user opens the block-attribute panel, the renderer constructs HTML using raw cell values from the AV store.

Four cell-type branches return raw content: text, url, phone, and mAsset. A payload such as </textarea><img src=x onerror="..."> or "><img src=x onerror="..."> escapes its surrounding tag and executes arbitrary JavaScript in the renderer context.

On Electron desktop, the renderer process runs with nodeIntegration:true. This grants the injected script access to Node.js APIs including require('child_process'), allowing arbitrary command execution on the host. The kernel does not escape input on write, so the malicious cell persists byte-for-byte and rides normal sync to every device.

Root Cause

The renderer lacks output encoding for AV cell values in the affected branches. There is no equivalent to the html.EscapeAttrVal call that protects block IAL attributes at kernel/model/blockial.go:261. Both kernel ingest and renderer output paths fail to neutralize HTML metacharacters.

Attack Vector

An attacker with write access to any synced workspace plants the payload once in an AV cell of type text, url, phone, or mAsset. The malicious row syncs to all collaborating devices. When any victim opens a block-attribute panel containing that row, the payload executes in the renderer. On Electron desktop the script invokes require('child_process').exec(...) to run arbitrary commands as the SiYuan user. See the GitHub Security Advisory GHSA-5xfx-xj4h-5p7r for technical details.

Detection Methods for CVE-2026-54158

Indicators of Compromise

AV data files under the SiYuan workspace containing HTML tag-breaking sequences such as </textarea>, "><img, or onerror= inside cell values
Unexpected child processes spawned by the SiYuan Electron binary, particularly shells, PowerShell, or scripting interpreters
Outbound network connections from the SiYuan process to attacker-controlled hosts immediately after a user opens a block-attribute panel

Detection Strategies

Scan synced workspace AV JSON files for HTML metacharacters and known XSS sink patterns in text, url, phone, and mAsset fields
Monitor process creation events where the parent process is the SiYuan Electron executable and the child is cmd.exe, powershell.exe, /bin/sh, or bash
Inspect renderer crash dumps or DevTools logs for script execution originating from attribute-view rendering paths

Monitoring Recommendations

Enable endpoint process-lineage telemetry for the SiYuan binary across Windows, macOS, and Linux desktops
Audit shared workspace write access and log changes to AV files in sync providers (WebDAV, S3, third-party cloud)
Alert on first execution of new commands by the SiYuan process and on unusual outbound network destinations from desktop knowledge-management apps

How to Mitigate CVE-2026-54158

Immediate Actions Required

Upgrade all SiYuan installations to version 3.7.0 or later on every synced device before reopening shared workspaces
Audit shared workspaces for malicious AV cell content and remove any rows containing HTML tag-breaking payloads
Revoke write access for untrusted collaborators on synced workspaces until all clients are patched

Patch Information

The vulnerability is fixed in SiYuan 3.7.0. The patch adds HTML escaping to the affected branches of genAVValueHTML, aligning AV cell rendering with the existing html.EscapeAttrVal protections used for block IAL attributes. Refer to the GitHub Security Advisory GHSA-5xfx-xj4h-5p7r for the official fix details.

Workarounds

Do not open block-attribute panels on untrusted or shared workspaces until all clients are updated to 3.7.0
Restrict workspace sync to trusted collaborators and disable shared write access where feasible
Where possible, use the web client over the Electron desktop client to avoid the nodeIntegration:true RCE chain, accepting that browser-context XSS still applies

bash

# Verify installed SiYuan version and upgrade
siyuan --version
# Upgrade to 3.7.0 or later via the official release channel:
# https://github.com/siyuan-note/siyuan/releases