Back Feedly

CVE-2026-50551 - Exploits & Severity

Feedly • June 25, 2026

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NVD published the first details for CVE-2026-50551

Feedly found the first article mentioning CVE-2026-50551 . See article

CVE-2026-50551 | SiYuan up to 3.6.x cross site scripting (GHSA-56mp-4f3v-fgj2)

CVE-2026-50551 - SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content CVE ID : CVE-2026-50551 Published : June 24, 2026, 9:20 p.m. | 3 hours, 50 minutes ago Description : SiYuan is an open-source personal knowledge management system. Prior to 3.7.0...

Collect, analyze, and vulnerability reports faster using AI

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Stored XSS Vulnerability in SiYuan Enables Remote Code Execution SiYuan, an open-source personal knowledge management system, has disclosed a critical stored cross-site scripting (XSS) vulnerability that can escalate to remote code execution (RCE) in its Electron desktop client. The flaw, tracked as CVE-2026-54158, affects versions prior to 3.7.0 and arises from unsafe HTML rendering in attribute-view cells. Attackers can exploit this vulnerability by inserting malicious content into text, URL, phone, and asset fields, which is then executed when a victim interacts with the affected content. The impact is exacerbated by insecure Electron settings, allowing injected JavaScript to access Node.js APIs. This vulnerability was published on June 24, 2026, and has a CVSS score of 9.9, indicating its critical nature. Users are advised to upgrade to version 3.7.0 to mitigate the risk. Two related advisories were published on June 3, 2026, highlighting similar stored XSS vulnerabilities in SiYuan's attribute-view rendering. 7 sources 78

Extracted Entities

CVE-2026-50551 - Exploits & Severity

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)