Plattform
go
Komponente
github.com/siyuan-note/siyuan/kernel
Behoben in
3.6.3
0.0.0-20260329142331-918d1bd9f967
CVE-2026-34585 describes a stored Cross-Site Scripting (XSS) vulnerability within the SiYuan Kernel, the core component of the SiYuan note-taking application. This vulnerability allows attackers to inject malicious JavaScript code, potentially leading to remote code execution within the Electron desktop client. The vulnerability impacts versions prior to 0.0.0-20260329142331-918d1bd9f967, and a patch has been released to address the issue.
An attacker can exploit this vulnerability by crafting a malicious SiYuan document (.sy) containing specially crafted block attribute values. These values, when imported via the standard Import -> SiYuan .sy.zip workflow, bypass server-side attribute escaping. The malicious attribute then breaks out of its original HTML context and injects an event handler. Crucially, within the Electron desktop client, this injected JavaScript code executes with the privileges of the user running the application, enabling remote code execution. This allows an attacker to potentially steal sensitive data, modify application behavior, or even gain control of the user's system. The impact is particularly severe due to the potential for remote code execution.
CVE-2026-34585 was publicly disclosed on 2026-04-01. No public proof-of-concept (POC) code has been released at the time of writing, but the vulnerability's nature suggests a relatively low barrier to exploitation. It is not currently listed on the CISA KEV catalog. The vulnerability's reliance on a specific import workflow may limit its immediate exploitability in widespread campaigns, but the potential for remote code execution warrants careful attention.
Users of Siyuan's Electron desktop client are particularly at risk due to the potential for Remote Code Execution. Individuals who frequently import .sy documents from external sources, especially those who share notes or collaborate with others, are also at higher risk. Shared hosting environments where multiple users share the same Siyuan installation are also vulnerable.
• windows / supply-chain: Monitor PowerShell execution for suspicious commands related to file manipulation and import processes. Check Autoruns for unusual entries related to Siyuan.
Get-Process -Name siyuan | Select-Object -ExpandProperty Path• linux / server: Monitor system logs (journalctl) for errors or unusual activity related to Siyuan's import functionality.
journalctl -u siyuan -f | grep -i error• generic web: Examine access and error logs for requests related to importing .sy.zip files. Check for unusual characters or patterns in the request parameters.
• database (mysql, redis, mongodb, postgresql): N/A - This vulnerability does not directly impact databases.
disclosure
patch
Exploit-Status
EPSS
0.07% (21% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2026-34585 is to immediately upgrade to version 0.0.0-20260329142331-918d1bd9f967 or later. If upgrading is not immediately feasible, consider temporarily disabling the import functionality for .sy.zip files. While not a complete solution, this reduces the attack surface. Review any imported .sy documents for suspicious content before opening them. There are no specific WAF or proxy rules that can directly prevent this type of XSS, as it relies on crafted document content. Monitor SiYuan application logs for unusual activity or errors related to document parsing and attribute handling.
Actualice SiYuan a la versión 3.6.2 o posterior. Esta versión contiene una corrección para la vulnerabilidad XSS almacenada que permite la ejecución de comandos arbitrarios. La actualización se puede realizar a través del sistema de actualización integrado en la aplicación o descargando la última versión desde el sitio web oficial.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2026-34585 is a stored Cross-Site Scripting (XSS) vulnerability in Siyuan Kernel that allows attackers to inject malicious JavaScript through crafted .sy documents.
You are affected if you are using Siyuan Kernel versions prior to 0.0.0-20260329142331-918d1bd9f967, especially if you use the Electron desktop client.
Upgrade to version 0.0.0-20260329142331-918d1bd9f967 or later. Restrict import of untrusted .sy.zip files.
There is currently no evidence of active exploitation, but the potential for RCE makes it a likely target.
Refer to the official Siyuan project website and GitHub repository for the latest security advisories and updates.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Lade deine go.mod-Datei hoch und wir sagen dir sofort, ob du betroffen bist.