CVE-2026-66396 Overview
CVE-2026-66396 is a stored cross-site scripting (XSS) vulnerability in SiYuan, a self-hosted personal knowledge management application, affecting versions before v3.7.2. The flaw resides in the rendering logic for Gallery and Kanban cover images, where the title-img value from the Individual Attribute List (IAL) is interpolated into a style attribute without escaping. Attackers with editor permissions can inject onload handlers that execute JavaScript. Because SiYuan runs inside an Electron renderer with full Node.js access, the XSS escalates to remote code execution (RCE) when a victim opens an affected document. The issue is tracked as CWE-79.
Critical Impact
Stored XSS chains into arbitrary code execution on the host through the Electron renderer's Node.js integration, giving attackers full control of the victim workstation.
Affected Products
- SiYuan note-taking application versions prior to v3.7.2
- SiYuan Electron desktop client (Windows, macOS, Linux)
- SiYuan workspaces shared between users with editor permissions
Discovery Timeline
- 2026-07-27 - CVE-2026-66396 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-66396
Vulnerability Analysis
SiYuan supports block-level metadata through its Individual Attribute List (IAL) syntax, which includes a title-img attribute used to display a cover image on Gallery and Kanban views. When the frontend renders these views, the title-img value is inserted directly into an inline style attribute string. Because the interpolation is unescaped, an attacker controlling the attribute can break out of the CSS context and inject additional HTML attributes such as onload. The payload is persisted with the document, so any user who later opens the note triggers execution.
SiYuan ships as an Electron application, and its renderer process retains Node.js integration. JavaScript executing inside the renderer can invoke require('child_process') and spawn arbitrary binaries. The XSS therefore behaves as a full RCE primitive rather than a browser-scoped script issue.
Root Cause
The root cause is missing output encoding on user-controlled IAL values during template rendering of cover images. The title-img string is concatenated into HTML markup instead of being written through a sink that escapes quotes and angle brackets, violating standard XSS prevention practices for the style attribute context.
Attack Vector
An attacker who has editor rights on a shared SiYuan workspace crafts a document with a malicious title-img IAL value containing an image URL followed by attribute-breakout characters and an onload handler. When the document is opened in a Gallery or Kanban view, the injected handler runs in the Electron renderer and can execute host commands. Exploitation requires the target to open the poisoned document (UI:P) and the attacker to hold editor privileges (PR:H).
See the GitHub Security Advisory GHSA-5rxg-wh59-mg34 and the VulnCheck advisory on XSS to RCE for detailed proof-of-concept information.
Detection Methods for CVE-2026-66396
Indicators of Compromise
- SiYuan documents containing title-img attribute values with quote characters, angle brackets, or the substring onload=
- Unexpected child processes spawned by the SiYuan Electron binary, particularly shells, powershell.exe, cmd.exe, or scripting interpreters
- Outbound network connections from the SiYuan process to previously unseen hosts shortly after a document is opened
Detection Strategies
- Scan SiYuan workspace data directories for block attribute files containing suspicious title-img payloads with HTML control characters
- Alert on process lineage where the SiYuan renderer spawns command interpreters or writes executables to disk
- Correlate document-open events with new persistence artifacts such as scheduled tasks, launch agents, or startup registry keys
Monitoring Recommendations
- Enable command-line auditing on endpoints running SiYuan and forward events to a central log store for review
- Track SiYuan version inventory across the fleet and flag hosts running builds older than v3.7.2
- Review shared workspace access logs for editor-permission grants issued to untrusted or recently added accounts
How to Mitigate CVE-2026-66396
Immediate Actions Required
- Upgrade all SiYuan installations to v3.7.2 or later on every desktop client and self-hosted server
- Audit existing notes for malicious title-img IAL values and remove or sanitize affected blocks before reopening documents
- Revoke editor permissions from untrusted collaborators on shared workspaces until patching is complete
Patch Information
The vendor released SiYuan v3.7.2, which escapes the title-img value before interpolation into the rendered style attribute. Details are documented in the GitHub Security Advisory GHSA-5rxg-wh59-mg34. Administrators should verify the running version through the application's About dialog after upgrading.
Workarounds
- Restrict workspace editor access to a small, trusted user set until the upgrade is deployed
- Avoid opening Gallery or Kanban views on documents received from untrusted sources
- Run SiYuan on a low-privilege user account to limit the blast radius of any successful RCE
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
