CVE-2026-54759: SiYuan Knowledge System RCE Vulnerability

CVE-2026-54759 Overview

CVE-2026-54759 affects SiYuan, an open-source personal knowledge management system, in versions prior to 3.7.0. The vulnerability resides in Lute's HyperText Markup Language (HTML) sanitizer, which fails to strip <iframe> elements from rendered content. When combined with the permissive security configuration of the SiYuan Electron client, an attacker can embed a malicious <iframe> inside a Bazaar package README. Viewing the package details, without installing the package, triggers arbitrary command execution on the victim's machine. The issue is tracked as [CWE-79] Cross-Site Scripting (XSS) and resolved in version 3.7.0.

Critical Impact
Arbitrary command execution on the victim's host occurs simply by previewing a malicious Bazaar package README, without any package installation.

Affected Products

SiYuan personal knowledge management system versions prior to 3.7.0
SiYuan Electron desktop client using the bundled Lute Markdown engine
Bazaar package marketplace integration within SiYuan

Discovery Timeline

2026-06-24 - CVE-2026-54759 published to the National Vulnerability Database (NVD)
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54759

Vulnerability Analysis

The flaw is a stored XSS condition that escalates to Remote Code Execution (RCE) because of the host environment. SiYuan uses Lute, a Markdown engine that performs HTML sanitization on rendered content. The sanitizer allow-list omits the <iframe> tag, leaving it intact in the output Document Object Model (DOM). Bazaar is SiYuan's in-app marketplace where users browse third-party themes, plugins, templates, and widgets. Each Bazaar package ships a README rendered inside the SiYuan client when a user opens the package details view.

The SiYuan desktop application is built on Electron, which embeds Chromium and Node.js. When the renderer process runs with permissive settings such as nodeIntegration enabled or sandboxing disabled, JavaScript loaded into the page can call Node.js Application Programming Interfaces (APIs) including child_process.exec. An attacker-controlled <iframe> in the README can load a remote payload that invokes these APIs and runs operating system commands under the victim's user account.

Root Cause

The root cause is incomplete output sanitization in Lute combined with an over-privileged Electron renderer. The HTML sanitizer does not enumerate <iframe> as a disallowed element, so embedded frames survive into the rendered view. The Electron security configuration does not isolate untrusted content from native APIs, removing the boundary that would normally contain an XSS payload.

Attack Vector

An attacker publishes a Bazaar package whose README contains a crafted <iframe> pointing to an attacker-hosted page. The victim browses Bazaar inside SiYuan and clicks the package to view its details. The README renders, the iframe loads, and the embedded script executes commands on the victim's host. The attack requires user interaction limited to viewing the package and does not require authentication or installation.

No verified public exploit code is available. See the GitHub Security Advisory for vendor technical details.

Detection Methods for CVE-2026-54759

Indicators of Compromise

Unexpected child processes spawned by the SiYuan Electron client such as cmd.exe, powershell.exe, bash, or sh
Outbound network connections from the SiYuan process to domains referenced inside Bazaar package README files
Bazaar package README markdown containing <iframe> tags or srcdoc attributes

Detection Strategies

Inspect Bazaar package repositories and cached README files for <iframe>, <script>, or javascript: URIs prior to viewing
Hunt endpoint telemetry for SiYuan spawning shells or scripting interpreters, which is not expected behavior
Correlate process creation events with SiYuan window focus on Bazaar views to identify view-triggered execution

Monitoring Recommendations

Enable process creation and command-line auditing on hosts running SiYuan and forward events to a Security Information and Event Management (SIEM) platform
Monitor SiYuan's installation directory and user profile for new executables or scheduled tasks created shortly after Bazaar browsing
Track network egress from the SiYuan binary to non-Bazaar domains

How to Mitigate CVE-2026-54759

Immediate Actions Required

Upgrade SiYuan to version 3.7.0 or later on all desktop and server installations
Avoid browsing or previewing untrusted Bazaar packages on versions prior to 3.7.0
Review recent Bazaar package interactions and inspect hosts for unexpected processes or persistence artifacts

Patch Information

The vendor fixed CVE-2026-54759 in SiYuan 3.7.0 by updating Lute's HTML sanitizer to remove <iframe> elements from rendered content. Refer to the GitHub Security Advisory GHSA-r6v5-4c66-f6pw for release notes and patch details.

Workarounds

Restrict SiYuan to trusted Bazaar sources and disable browsing of community packages until the upgrade is applied
Run the SiYuan client under a least-privileged user account to limit the blast radius of command execution
Apply application allow-listing to block SiYuan from launching shell interpreters or scripting hosts

bash

# Verify the installed SiYuan version is patched
siyuan --version
# Expected output: 3.7.0 or later