CVE-2026-33066
published 2026-03-20CVE-2026-33066: SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the backend renderREADME function uses lute.New() without calling…
PriorityP356critical9CVSS 3.1
AVNACLPRLUIRSCCHIHAH
EPSS
0.58%
43.5th percentile
SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the backend renderREADME function uses lute.New() without calling SetSanitize(true), allowing raw HTML embedded in Markdown to pass through unmodified. The frontend then assigns the rendered HTML to innerHTML without any additional sanitization. A malicious package author can embed arbitrary JavaScript in their README that executes when a user clicks to view the package details. Because SiYuan's Electron configuration enables nodeIntegration: true with contextIsolation: false, this XSS escalates directly to full Remote Code Execution. The issue was patched in version 3.6.1.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| b3log | siyuan | < 3.6.1 | 3.6.1 |
| b3log | siyuan | >= 3.6.1 < 3.6.4 | 3.6.4 |
| github.com | siyuan-note_siyuan_kernel | >= 0 < 0.0.0-20260414013942-62eed37a3263 | 0.0.0-20260414013942-62eed37a3263 |
| github.com | siyuan-note_siyuan_kernel | >= 0 < 0.0.0-20260314111550-b382f50e1880 | 0.0.0-20260314111550-b382f50e1880 |
| siyuan-note | siyuan | < 3.6.4 | 3.6.4 |
CVSS provenance
nvdv3.19.0CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
SiYuan has incomplete fix for CVE-2026-33066: XSS
ghsa·2026-04-14·CVSS 5.3
CVE-2026-33066 [MEDIUM] CWE-79 SiYuan has incomplete fix for CVE-2026-33066: XSS
SiYuan has incomplete fix for CVE-2026-33066: XSS
### Summary
The incomplete fix for SiYuan's bazaar README rendering enables the Lute HTML sanitizer but fails to block `` tags, allowing stored XSS via `srcdoc` attributes containing embedded scripts that execute in the Electron context.
### Affected Package
- **Ecosystem:** Go
- **Package:** github.com/siyuan-note/siyuan
- **Affected versions:** = commit b382f50e1880
### Details
The `renderPackageREADME()` function in `kernel/bazaar/readme.go` renders Markdown README content from bazaar (marketplace) packages into HTML. The original vulnerability allowed stored XSS through unsanitized HTML in READMEs. The fix adds `luteEngine.SetSanitize(true)` to enable Lute's built-in HTML sanitizer.
However, the Lute sanitizer in `lute/render/san
OSV
SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering in github.com/siyuan-note/siyuan/kernel
osv·2026-03-23
CVE-2026-33066 SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering in github.com/siyuan-note/siyuan/kernel
SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering in github.com/siyuan-note/siyuan/kernel
SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering in github.com/siyuan-note/siyuan/kernel
GHSA
SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering
ghsa·2026-03-18
CVE-2026-33066 [MEDIUM] CWE-79 SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering
SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering
# Stored XSS to RCE via Unsanitized Bazaar README Rendering
## Summary
SiYuan's Bazaar (community marketplace) renders package README content without HTML sanitization. The backend `renderREADME` function uses `lute.New()` without calling `SetSanitize(true)`, allowing raw HTML embedded in Markdown to pass through unmodified. The frontend then assigns the rendered HTML to `innerHTML` without any additional sanitization. A malicious package author can embed arbitrary JavaScript in their README that executes when a user clicks to view the package details. Because SiYuan's Electron configuration enables `nodeIntegration: true` with `contextIsolation: false`, this XSS escalates directly to full Remote Code Execution.
## Af
OSV
SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering
osv·2026-03-18
CVE-2026-33066 [MEDIUM] SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering
SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering
# Stored XSS to RCE via Unsanitized Bazaar README Rendering
## Summary
SiYuan's Bazaar (community marketplace) renders package README content without HTML sanitization. The backend `renderREADME` function uses `lute.New()` without calling `SetSanitize(true)`, allowing raw HTML embedded in Markdown to pass through unmodified. The frontend then assigns the rendered HTML to `innerHTML` without any additional sanitization. A malicious package author can embed arbitrary JavaScript in their README that executes when a user clicks to view the package details. Because SiYuan's Electron configuration enables `nodeIntegration: true` with `contextIsolation: false`, this XSS escalates directly to full Remote Code Execution.
## Af
No detection rules found.
No public exploits indexed.
2026-03-20
Published