CVE-2026-59855 Details
Description
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/src/asset/index.ts interpolates the unsanitized this.path value into HTML assigned to innerHTML, allowing a crafted asset link containing a double quote to break out of the src attribute, inject an event handler, and execute JavaScript that can run OS commands in the Electron renderer. This issue is fixed in versions 3.7.1-alpha.2 and 3.7.1.
A critical DOM-based Cross-Site Scripting vulnerability has been identified in SiYuan, an open-source personal knowledge management system, in versions prior to 3.7.1. The issue arises in the Asset.render method, where unsanitized asset link paths are interpolated into HTML. This allows an attacker to inject a double quote to escape the src attribute, insert an event handler, and execute JavaScript that can run operating system commands within the Electron renderer. The vulnerability is exacerbated by the Electron application's default settings, which enable node integration and disable context isolation, allowing for unauthenticated remote code execution on the victim's machine.
Users can update to SiYuan versions 3.7.1-alpha.2 or 3.7.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 9, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w3gq-5j72-36vc | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/siyuan-note/siyuan/commit/efbe3a557720034782643e55c9e0282530cb6bbb | [email protected] | Source CodeVendor |
| https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1 | [email protected] | Release NotesVendor |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w3gq-5j72-36vc | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SiYuan | <= 3.6.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |