CVE-2026-50551: SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-24 · updated 2026-10-25
Weakness: CWE-79

Description

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.

Affected products

siyuan-note siyuan: before 3.7.0

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-56mp-4f3v-fgj2
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-56mp-4f3v-fgj2

Get alerted when CVE-2026-50551 or the next vulnerability affects your stack