CVE-2026-55570 Details
Description
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape the untrusted fields (name, version, author, description) when they are serialized into the data-obj HTML attribute of each marketplace card. Because the attribute is single-quoted and the value is produced with JSON.stringify() (which does not escape ', <, or >), a package whose name contains a single quote breaks out of the attribute and injects arbitrary HTML. In the desktop client the main BrowserWindow runs with nodeIntegration: true, contextIsolation: false, so the injected markup escalates from DOM XSS to arbitrary OS command execution. This is the same root cause and same impact as the original advisory, reached through a sibling sink the patch did not cover. This vulnerability is fixed in 3.7.0.
A vulnerability in SiYuan, an open-source personal knowledge management system, allows for data-object attribute injection that escalates from DOM-based cross-site scripting (XSS) to remote code execution (RCE) on the operating system. This issue affects SiYuan versions prior to 3.7.0. The vulnerability arises because untrusted fields such as name, version, author, and description are not properly escaped when serialized into the data-obj HTML attribute of marketplace cards. The data-obj attribute is single-quoted, and values are generated with JSON.stringify(), which fails to escape certain characters. As a result, a package name containing a single quote can break out of the attribute and inject arbitrary HTML. In the desktop client, the main BrowserWindow has nodeIntegration enabled and contextIsolation disabled, allowing the injected HTML to execute OS commands.
Users can update to SiYuan version 3.7.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x88j-wgpr-h22x | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x88j-wgpr-h22x | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SiYuan | <= v3.6.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |