CVE-2026-39846
published 2026-04-07CVE-2026-39846: SiYuan is a personal knowledge management system. Prior to 3.6.4, a malicious note synced to another user can trigger remote code execution in the SiYuan…
PriorityP355critical9CVSS 3.1
AVNACLPRLUIRSCCHIHAH
EPSS
0.54%
41.2th percentile
SiYuan is a personal knowledge management system. Prior to 3.6.4, a malicious note synced to another user can trigger remote code execution in the SiYuan Electron desktop client. The root cause is that table caption content is stored without safe escaping and later unescaped into rendered HTML, creating a stored XSS sink. Because the desktop renderer runs with nodeIntegration enabled and contextIsolation disabled, attacker-controlled JavaScript executes with access to Node.js APIs. In practice, an attacker can import a crafted note into a synced workspace, wait for the victim to sync, and achieve code execution when the victim opens the note. This vulnerability is fixed in 3.6.4.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| b3log | siyuan | < 3.6.4 | 3.6.4 |
| github.com | siyuan-note_siyuan_kernel | >= 0 < 0.0.0-20260407035653-2f416e5253f1 | 0.0.0-20260407035653-2f416e5253f1 |
| siyuan-note | siyuan | < 3.6.4 | 3.6.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions
ghsa·2026-04-08
CVE-2026-39846 [CRITICAL] CWE-79 SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions
SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions
### Summary
A malicious note synced to another user can trigger remote code execution in the SiYuan Electron desktop client. The root cause is that table caption content is stored without safe escaping and later unescaped into rendered HTML, creating a stored XSS sink. Because the desktop renderer runs with `nodeIntegration` enabled and `contextIsolation` disabled, attacker-controlled JavaScript executes with access to Node.js APIs. In practice, an attacker can import a crafted note into a synced workspace, wait for the victim to sync, and achieve code execution when the victim opens the note.
### Details
The vulnerability exists in the table caption handling path. When a table block is p
OSV
SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions
osv·2026-04-08
CVE-2026-39846 [CRITICAL] SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions
SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions
### Summary
A malicious note synced to another user can trigger remote code execution in the SiYuan Electron desktop client. The root cause is that table caption content is stored without safe escaping and later unescaped into rendered HTML, creating a stored XSS sink. Because the desktop renderer runs with `nodeIntegration` enabled and `contextIsolation` disabled, attacker-controlled JavaScript executes with access to Node.js APIs. In practice, an attacker can import a crafted note into a synced workspace, wait for the victim to sync, and achieve code execution when the victim opens the note.
### Details
The vulnerability exists in the table caption handling path. When a table block is p
No detection rules found.
No public exploits indexed.
2026-04-07
Published