CVE-2026-50551

Published: Jun 24, 2026Modified: Jun 25, 2026Deferred

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: security-advisories@github.com (Secondary)

Description

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-56mp-4f3v-fgj2

Source: security-advisories@github.com

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-56mp-4f3v-fgj2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.