CVE-2026-32751 Details
Description
SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the mobile file tree (MobileFiles.ts) renders notebook names via innerHTML without HTML escaping when processing renamenotebook WebSocket events. The desktop version (Files.ts) properly uses escapeHtml() for the same operation. An authenticated user who can rename notebooks can inject arbitrary HTML/JavaScript that executes on any mobile client viewing the file tree. Since Electron is configured with nodeIntegration: true and contextIsolation: false, the injected JavaScript has full Node.js access, escalating stored XSS to full remote code execution. The mobile layout is also used in the Electron desktop app when the window is narrow, making this exploitable on desktop as well. This issue has been fixed in version 3.6.1.
A stored cross-site scripting vulnerability has been identified in SiYuan personal knowledge management system, affecting versions through 3.5.9. The issue arises in the mobile file tree component, which processes notebook names from WebSocket events without proper HTML escaping. This flaw allows an authenticated user to inject arbitrary HTML or JavaScript that executes on mobile clients viewing the file tree. The injected JavaScript can leverage Node.js capabilities, leading to remote code execution. Notably, this vulnerability also impacts the desktop version of the application under certain conditions.
Users can update to SiYuan version 3.6.1, which addresses this vulnerability by implementing proper HTML escaping in the mobile file tree component and sanitizing notebook names on the backend.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/commit/f6d35103f774b65e52f03e018649ff0e57924fb0 | [email protected] | Patch |
| https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1 | [email protected] | Release Notes |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qr46-rcv3-4hq3 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| b3log siyuan | < 3.6.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 19, 2026 | New CVE Received | [email protected] |