CVE-2026-34449
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
SiYuan, a personal knowledge management system, prior to version 3.6.2 allows a malicious website to achieve Remote Code Execution (RCE) on any desktop running SiYuan. This is due to an overly permissive CORS policy (Access-Control-Allow-Origin: * + Access-Control-Allow-Private-Network: true) that enables injecting JavaScript via the API. The injected code executes in Electron's Node.js context with full OS access the next time the user opens SiYuan's UI. No user interaction is required beyond visiting the malicious website while SiYuan is running.
Risk Assessment
An attacker can gain full control over the user's system, execute arbitrary commands, steal data, or install malware without the user's knowledge.
Recommendation
Upgrade SiYuan to version 3.6.2, which includes a fix that restricts the CORS policy and prevents this vulnerability.
Original NVD description (English source)
SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (Access-Control-Allow-Origin: * + Access-Control-Allow-Private-Network: true) to inject a JavaScript snippet via the API. The injected snippet executes in Electron's Node.js context with full OS access the next time the user opens SiYuan's UI. No user interaction is required beyond visiting the malicious website while SiYuan is running. This issue has been patched in version 3.6.2.