CVE-2026-34449 Details
Description
SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (Access-Control-Allow-Origin: * + Access-Control-Allow-Private-Network: true) to inject a JavaScript snippet via the API. The injected snippet executes in Electron's Node.js context with full OS access the next time the user opens SiYuan's UI. No user interaction is required beyond visiting the malicious website while SiYuan is running. This issue has been patched in version 3.6.2.
A remote code execution vulnerability has been identified in SiYuan, a personal knowledge management system, prior to version 3.6.2. The issue arises from a permissive Cross-Origin Resource Sharing (CORS) policy that allows malicious websites to inject JavaScript snippets through the SiYuan API. Once injected, these snippets execute in the context of Electron's Node.js environment, with full access to the operating system, the next time the user opens the SiYuan interface. Exploitation requires no user interaction beyond visiting the malicious website while SiYuan is active.
Users can update to SiYuan version 3.6.2, which addresses this vulnerability by improving the application's CORS policy and enhancing overall security.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-68p4-j234-43mv | CISA-ADP | ExploitVendor Advisory |
| https://github.com/siyuan-note/siyuan/issues/17246 | [email protected] | Issue Tracking |
| https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2 | [email protected] | Release Notes |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-68p4-j234-43mv | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-942 | Permissive Cross-domain Policy with Untrusted Domains | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| b3log siyuan | < 3.6.2 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 3, 2026 | Initial Analysis | [email protected] |
| Apr 1, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | New CVE Received | [email protected] |