CVE-2026-39846
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
SiYuan prior to 3.6.4 contains a stored XSS vulnerability that allows remote code execution in the Electron desktop client. An attacker can import a crafted note into a synced workspace, and when the victim opens it, attacker-controlled JavaScript executes with access to Node.js APIs.
Risk Assessment
The risk for the organization is the potential compromise of the user's workstation through arbitrary JavaScript execution with Node.js privileges, which can lead to data theft, malware installation, or lateral movement within the network.
Recommendation
Immediately update SiYuan to version 3.6.4 or later. Until the update is applied, disable note synchronization from untrusted sources and restrict access to shared workspaces.
Original NVD description (English source)
SiYuan is a personal knowledge management system. Prior to 3.6.4, a malicious note synced to another user can trigger remote code execution in the SiYuan Electron desktop client. The root cause is that table caption content is stored without safe escaping and later unescaped into rendered HTML, creating a stored XSS sink. Because the desktop renderer runs with nodeIntegration enabled and contextIsolation disabled, attacker-controlled JavaScript executes with access to Node.js APIs. In practice, an attacker can import a crafted note into a synced workspace, wait for the victim to sync, and achieve code execution when the victim opens the note. This vulnerability is fixed in 3.6.4.