CVE-2026-50551 AKAOMA CVE VULNERABILITIES / 13h SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.

Back cve.akaoma.com

CVE-2026-50551 AKAOMA CVE VULNERABILITIES / 13h SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.

cve.akaoma.com • June 25, 2026

Share: View original

9.9 /10 Critical Risk As a catastrophic security flaw, CVE-2026-50551 has severe implications, demanding immediate intervention.

As a catastrophic security flaw, CVE-2026-50551 has severe implications, demanding immediate intervention.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Stored XSS Vulnerability in SiYuan Enables Remote Code Execution SiYuan, an open-source personal knowledge management system, has disclosed a critical stored cross-site scripting (XSS) vulnerability that can escalate to remote code execution (RCE) in its Electron desktop client. The flaw, tracked as CVE-2026-54158, affects versions prior to 3.7.0 and arises from unsafe HTML rendering in attribute-view cells. Attackers can exploit this vulnerability by inserting malicious content into text, URL, phone, and asset fields, which is then executed when a victim interacts with the affected content. The impact is exacerbated by insecure Electron settings, allowing injected JavaScript to access Node.js APIs. This vulnerability was published on June 24, 2026, and has a CVSS score of 9.9, indicating its critical nature. Users are advised to upgrade to version 3.7.0 to mitigate the risk. Two related advisories were published on June 3, 2026, highlighting similar stored XSS vulnerabilities in SiYuan's attribute-view rendering. 7 sources 78

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Cwe-79 - Cross-site Scripting (xss)

Vulnerabilities (1)