SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

published 2026-06-24 4 mo ago modified 2026-10-25 14 d ago also GHSA-mvjr-vv3c-w4qv , GO-2026-5963 , EUVD-2026-39123

cvss: 9.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 32%
public exploits: 0; none known

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, CSS snippet body containing </style> breaks out of its surrounding <style> tag when renderSnippet() interpolates it via insertAdjacentHTML. A payload like runs arbitrary JavaScript in the renderer. On Electron desktop builds the renderer runs with nodeIntegration:true, so require('child_process') is reachable from the injected handler and the XSS chains to host RCE. Snippets sync via the workspace repository, so an attacker with write access to any synced workspace plants the payload once and it fires on every device that pulls. The bug also bypasses the user's enabledCSS / enabledJS separation. A user who turned enabledJS off was making a deliberate call not to run untrusted JavaScript; the CSS path runs it anyway. This vulnerability is fixed in 3.7.0.

Patch / fix

fixed in 1 distros 1

go github.com/siyuan-note/siyuan/kernel 0.0.0-20260628153353-2d5d72223df4

govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 4 mo ago (2026-06-25)

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mvjr-vv3c-w4qv referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
GitHub	3.1	9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
go	github.com/siyuan-note/siyuan/kernel	<0.0.0-20260628153353-2d5d72223df4	0.0.0-20260628153353-2d5d72223df4

Affected products

siyuan-note siyuan

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation
CWE-1188 Initialization of a Resource with an Insecure Default

References

github.com /siyuan-note/siyuan/security/advisories/GHSA-mvjr-vv3c-w4qv
exploit, web, advisory
nvd.nist.gov /vuln/detail/CVE-2026-54067
advisory
github.com /siyuan-note/siyuan
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary