Vulnerability-Lookup

GHSA-56MP-4F3V-FGJ2

Vulnerability from github – Published: 2026-07-10 20:37 – Updated: 2026-07-10 20:37

Summary

SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

Details

SiYuan v3.6.5 and earlier versions contain a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This is a neighbor-bug of CVE-2026-44588: the fix for -44588 used escapeAriaLabel() (double-escapes <), but the AV asset renderers were left using the weaker escapeAttr() (escapes only quotes) or no escaping at all.

## Vulnerability Details

The Electron renderer is configured with nodeIntegration: true and contextIsolation: false (app/electron/main.js:307), allowing any JavaScript executing in the renderer to directly access Node.js APIs including require('child_process').

Two XSS sinks exist.

### Sink 1 (Direct Stored XSS - triggers on page load)

app/src/protyle/render/av/cell.ts:1008:

  text += `<span class="b3-chip av__celltext--url ariaLabel" aria-label="${escapeAttr(item.content)}" data-name="${escapeAttr(item.name)}"

data-url="${escapeAttr(item.content)}">${item.name || item.content}`;

The >${item.name || item.content}</span> portion is raw user input with zero escaping.

app/src/protyle/render/av/blockAttr.ts:93 (even worse - completely unescaped):

  html += `<img loading="lazy" class="av__cellassetimg ariaLabel" aria-label="${item.content}" src="${getCompressURL(item.content)}">`;

Rendered via action.ts:860: cellElement.innerHTML = renderCell(...) results in immediate XSS on page load.

### Sink 2 (Hover-triggered XSS via aria-label round-trip)

Same lines emit aria-label="${escapeAttr(item.content)}" on .ariaLabel elements.
escapeAttr() (util/escape.ts:14) escapes only " and ' — NOT < or >.
popover.ts:33 global mouseover handler reads aria-label via getAttribute (which attribute-decodes entities).
Line 144: showTooltip(decodeURIComponent(tip), ...) then tooltip.ts:41: messageElement.innerHTML = message results in XSS on hover.

### Source

app/src/protyle/render/av/asset.ts:405: addAssetLink() reads user input from a free-form <textarea> with no sanitization.
Kernel stores MAsset.Content raw (kernel/av/value.go:53), no server-side sanitization.

## Attack Vector

Attacker creates a malicious note containing an Attribute View (database).
Attacker adds an asset cell with link content: <img src=x onerror=require('child_process').exec('calc')>
Victim opens the note for immediate RCE (Sink 1), or hovers over the cell for RCE (Sink 2).
In a sync/collaboration scenario, the malicious note propagates to all users.

## Proof of Concept

Payload (Direct XSS) — in an AV asset cell link field, enter:

  <img src=x onerror=alert(document.domain)>

For RCE in Electron desktop:

  <img src=x onerror=require('child_process').exec('calc')>

### Steps to Reproduce

Open SiYuan desktop app (v3.6.5).
Create a new document.
Insert an Attribute View (database): / then select "Table".
Add a column of type "Asset".
Click the asset cell, then "Add Link".
In the "Link" textarea, paste: <img src=x onerror=alert(1)>
Leave "Title" empty or fill with benign text.
Click outside the dialog to save.
Observe: Alert fires immediately (Sink 1). Hovering over the cell also triggers (Sink 2).

## Impact

Remote Code Execution on victim's system via malicious note sync/import.
Data exfiltration: attacker can read all notes, access filesystem, steal credentials.
Persistence: malicious payload stored in .sy files, executes on every open.

## Suggested Fix

Replace escapeAttr() with escapeAriaLabel() for all aria-label attributes in AV cell renderers.
Escape item.name and item.content with escapeHtml() before concatenating into element text content.

Affected files: app/src/protyle/render/av/cell.ts, app/src/protyle/render/av/blockAttr.ts, app/src/protyle/render/av/asset.ts.

## Additional Context

This vulnerability is a neighbor-bug of CVE-2026-44588. The fix for -44588 correctly used escapeAriaLabel() (which double-escapes < to survive the attribute -> getAttribute -> innerHTML round-trip), but the AV asset cell renderers were left using the weaker escapeAttr() or no escaping. This is part of a pattern of incomplete fixes in SiYuan (see also CVE-2026-33066, CVE-2026-29183). The long-term fix should set ElectroncontextIsolation: true and nodeIntegration: false.

## Report Reporter (GitHub: Yunkaiwjs).

Severity

9.9 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260628153353-2d5d72223df4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-50551"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-10T20:37:04Z",
    "nvd_published_at": "2026-06-24T22:16:47Z",
    "severity": "CRITICAL"
  },
  "details": "SiYuan v3.6.5 and earlier versions contain a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This is a neighbor-bug of CVE-2026-44588: the fix for -44588 used `escapeAriaLabel()` (double-escapes `\u003c`), but the AV asset renderers were left using the weaker `escapeAttr()` (escapes only quotes) or no escaping at all.\n\n  ## Vulnerability Details\n\n  The Electron renderer is configured with `nodeIntegration: true` and `contextIsolation: false` (app/electron/main.js:307), allowing any JavaScript executing in the renderer to directly access Node.js APIs including `require(\u0027child_process\u0027)`.\n\n  Two XSS sinks exist.\n\n  ### Sink 1 (Direct Stored XSS - triggers on page load)\n\n  `app/src/protyle/render/av/cell.ts:1008`:\n\n      text += `\u003cspan class=\"b3-chip av__celltext--url ariaLabel\" aria-label=\"${escapeAttr(item.content)}\" data-name=\"${escapeAttr(item.name)}\"\n  data-url=\"${escapeAttr(item.content)}\"\u003e${item.name || item.content}\u003c/span\u003e`;\n\n  The `\u003e${item.name || item.content}\u003c/span\u003e` portion is raw user input with zero escaping.\n\n  `app/src/protyle/render/av/blockAttr.ts:93` (even worse - completely unescaped):\n\n      html += `\u003cimg loading=\"lazy\" class=\"av__cellassetimg ariaLabel\" aria-label=\"${item.content}\" src=\"${getCompressURL(item.content)}\"\u003e`;\n\n  Rendered via `action.ts:860`: `cellElement.innerHTML = renderCell(...)` results in immediate XSS on page load.\n\n  ### Sink 2 (Hover-triggered XSS via aria-label round-trip)\n\n  - Same lines emit `aria-label=\"${escapeAttr(item.content)}\"` on `.ariaLabel` elements.\n  - `escapeAttr()` (util/escape.ts:14) escapes only `\"` and `\u0027` \u2014 NOT `\u003c` or `\u003e`.\n  - `popover.ts:33` global mouseover handler reads `aria-label` via `getAttribute` (which attribute-decodes entities).\n  - Line 144: `showTooltip(decodeURIComponent(tip), ...)` then `tooltip.ts:41`: `messageElement.innerHTML = message` results in XSS on hover.\n\n  ### Source\n\n  - `app/src/protyle/render/av/asset.ts:405`: `addAssetLink()` reads user input from a free-form `\u003ctextarea\u003e` with no sanitization.\n  - Kernel stores `MAsset.Content` raw (kernel/av/value.go:53), no server-side sanitization.\n\n  ## Attack Vector\n\n  1. Attacker creates a malicious note containing an Attribute View (database).\n  2. Attacker adds an asset cell with link content: `\u003cimg src=x onerror=require(\u0027child_process\u0027).exec(\u0027calc\u0027)\u003e`\n  3. Victim opens the note for immediate RCE (Sink 1), or hovers over the cell for RCE (Sink 2).\n  4. In a sync/collaboration scenario, the malicious note propagates to all users.\n\n  ## Proof of Concept\n\n  Payload (Direct XSS) \u2014 in an AV asset cell link field, enter:\n\n      \u003cimg src=x onerror=alert(document.domain)\u003e\n\n  For RCE in Electron desktop:\n\n      \u003cimg src=x onerror=require(\u0027child_process\u0027).exec(\u0027calc\u0027)\u003e\n\n  ### Steps to Reproduce\n\n  1. Open SiYuan desktop app (v3.6.5).\n  2. Create a new document.\n  3. Insert an Attribute View (database): `/` then select \"Table\".\n  4. Add a column of type \"Asset\".\n  5. Click the asset cell, then \"Add Link\".\n  6. In the \"Link\" textarea, paste: `\u003cimg src=x onerror=alert(1)\u003e`\n  7. Leave \"Title\" empty or fill with benign text.\n  8. Click outside the dialog to save.\n  9. Observe: Alert fires immediately (Sink 1). Hovering over the cell also triggers (Sink 2).\n\n  ## Impact\n\n  - Remote Code Execution on victim\u0027s system via malicious note sync/import.\n  - Data exfiltration: attacker can read all notes, access filesystem, steal credentials.\n  - Persistence: malicious payload stored in `.sy` files, executes on every open.\n\n  ## Suggested Fix\n\n  1. Replace `escapeAttr()` with `escapeAriaLabel()` for all `aria-label` attributes in AV cell renderers.\n  2. Escape `item.name` and `item.content` with `escapeHtml()` before concatenating into element text content.\n\n  Affected files: `app/src/protyle/render/av/cell.ts`, `app/src/protyle/render/av/blockAttr.ts`, `app/src/protyle/render/av/asset.ts`.\n\n  ## Additional Context\n\n  This vulnerability is a neighbor-bug of CVE-2026-44588. The fix for -44588 correctly used `escapeAriaLabel()` (which double-escapes `\u003c` to survive the attribute -\u003e `getAttribute` -\u003e `innerHTML` round-trip), but the AV asset cell renderers were left using the weaker `escapeAttr()` or no escaping. This is part of a pattern of incomplete fixes in SiYuan (see also CVE-2026-33066, CVE-2026-29183). The long-term fix should set Electron`contextIsolation: true` and `nodeIntegration: false`.\n\n  ## Report\n Reporter (GitHub: Yunkaiwjs).",
  "id": "GHSA-56mp-4f3v-fgj2",
  "modified": "2026-07-10T20:37:04Z",
  "published": "2026-07-10T20:37:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-56mp-4f3v-fgj2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50551"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content"
}

CVE-2026-50551 (GCVE-0-2026-50551)

Vulnerability from cvelistv5 – Published: 2026-06-24 21:20 – Updated: 2026-06-25 13:20

Title

SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

Summary

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.

Severity

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-25 13:20 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/siyuan-note/siyuan/security/ad…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
siyuan-note	siyuan	Affected: < 3.7.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50551",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T13:20:21.383745Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-25T13:20:40.202Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-56mp-4f3v-fgj2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "siyuan",
          "vendor": "siyuan-note",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-24T21:20:42.004Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-56mp-4f3v-fgj2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-56mp-4f3v-fgj2"
        }
      ],
      "source": {
        "advisory": "GHSA-56mp-4f3v-fgj2",
        "discovery": "UNKNOWN"
      },
      "title": "SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50551",
    "datePublished": "2026-06-24T21:20:42.004Z",
    "dateReserved": "2026-06-04T20:37:18.654Z",
    "dateUpdated": "2026-06-25T13:20:40.202Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-56MP-4F3V-FGJ2

CVE-2026-50551 (GCVE-0-2026-50551)

Tags

Sightings

Nomenclature

Related by attack behaviour