CVE-2026-50551 National Vulnerability Database / 14h SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.

nvd.nist.gov • June 25, 2026

This CVE record has recently been published to the CVE List and has been included within the NVD dataset.

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Stored XSS Vulnerability in SiYuan Enables Remote Code Execution SiYuan, an open-source personal knowledge management system, has disclosed a critical stored cross-site scripting (XSS) vulnerability that can escalate to remote code execution (RCE) in its Electron desktop client. The flaw, tracked as CVE-2026-54158, affects versions prior to 3.7.0 and arises from unsafe HTML rendering in attribute-view cells. Attackers can exploit this vulnerability by inserting malicious content into text, URL, phone, and asset fields, which is then executed when a victim interacts with the affected content. The impact is exacerbated by insecure Electron settings, allowing injected JavaScript to access Node.js APIs. This vulnerability was published on June 24, 2026, and has a CVSS score of 9.9, indicating its critical nature. Users are advised to upgrade to version 3.7.0 to mitigate the risk. Two related advisories were published on June 3, 2026, highlighting similar stored XSS vulnerabilities in SiYuan's attribute-view rendering. 7 sources 78

Extracted Entities

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)