CVE-2026-44586

High

Published: 14/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

SiYuan is a knowledge management system that in versions from 2.1.12 to before 3.7.0 renders package author metadata from the public bazaar feed into HTML without proper escaping. In the desktop app, this leads to stored XSS, allowing code execution on the host.

Risk Assessment

This vulnerability poses a risk of executing malicious code on user devices, potentially leading to data loss or system takeover.

Recommendation

It is recommended to upgrade SiYuan to version 3.7.0 or later to mitigate this vulnerability.

Other vulnerabilities in SiYuan Bazaar marketplace

CVE-2026-56397Critical
SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript.

Original NVD description (English source)

SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan's Bazaar marketplace renders package author metadata from the public bazaar stage feed into HTML without escaping. In the desktop app this becomes stored XSS, and because SiYuan's Electron windows are created with nodeIntegration: true and contextIsolation: false, a successful payload can call Node.js APIs and execute code on the host. This vulnerability is fixed in 3.7.0.