CVE-2026-34448

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34448", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-27T18:18:14.895Z", "datePublished": "2026-03-31T21:44:36.504Z", "dateUpdated": "2026-04-03T16:05:31.678Z"}, "containers": {"cna": {"title": "SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rx4h-526q-4458", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rx4h-526q-4458"}, {"name": "https://github.com/siyuan-note/siyuan/issues/17246", "tags": ["x_refsource_MISC"], "url": "https://github.com/siyuan-note/siyuan/issues/17246"}, {"name": "https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2"}], "affected": [{"vendor": "siyuan-note", "product": "siyuan", "versions": [{"version": "< 3.6.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T21:44:36.504Z"}, "descriptions": [{"lang": "en", "value": "SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with \u201cCover From -> Asset Field\u201d enabled. The vulnerable code accepts arbitrary http(s) URLs without extensions as images, stores the attacker-controlled string in coverURL, and injects it directly into an <img src=\"...\"> attribute without escaping. In the Electron desktop client, the injected JavaScript executes with nodeIntegration enabled and contextIsolation disabled, so the XSS reaches arbitrary OS command execution under the victim\u2019s account. This issue has been patched in version 3.6.2."}], "source": {"advisory": "GHSA-rx4h-526q-4458", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-03T16:04:30.231225Z", "id": "CVE-2026-34448", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T16:05:31.678Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34448", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-03T16:04:30.231225Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T16:05:19.187Z"}}], "cna": {"title": "SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client", "source": {"advisory": "GHSA-rx4h-526q-4458", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "siyuan-note", "product": "siyuan", "versions": [{"status": "affected", "version": "< 3.6.2"}]}], "references": [{"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rx4h-526q-4458", "name": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rx4h-526q-4458", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/siyuan-note/siyuan/issues/17246", "name": "https://github.com/siyuan-note/siyuan/issues/17246", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2", "name": "https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with \u201cCover From -> Asset Field\u201d enabled. The vulnerable code accepts arbitrary http(s) URLs without extensions as images, stores the attacker-controlled string in coverURL, and injects it directly into an <img src=\"...\"> attribute without escaping. In the Electron desktop client, the injected JavaScript executes with nodeIntegration enabled and contextIsolation disabled, so the XSS reaches arbitrary OS command execution under the victim\u2019s account. This issue has been patched in version 3.6.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T21:44:36.504Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34448", "state": "PUBLISHED", "dateUpdated": "2026-04-03T16:05:31.678Z", "dateReserved": "2026-03-27T18:18:14.895Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-31T21:44:36.504Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "siyuan", "vendor": "siyuan-note", "versions": [{"status": "affected", "version": "< 3.6.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*", "matchCriteriaId": "27CB71A7-7208-417A-AE6D-266D57F683E9", "versionEndExcluding": "3.6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with \u201cCover From -> Asset Field\u201d enabled. The vulnerable code accepts arbitrary http(s) URLs without extensions as images, stores the attacker-controlled string in coverURL, and injects it directly into an <img src=\"...\"> attribute without escaping. In the Electron desktop client, the injected JavaScript executes with nodeIntegration enabled and contextIsolation disabled, so the XSS reaches arbitrary OS command execution under the victim\u2019s account. This issue has been patched in version 3.6.2."}, {"lang": "es", "value": "SiYuan es un sistema de gesti\u00f3n de conocimiento personal. Antes de la versi\u00f3n 3.6.2, un atacante que puede colocar una URL maliciosa en un campo 'mAsse' de la vista de atributos puede desencadenar XSS almacenado cuando una v\u00edctima abre la vista de Galer\u00eda o Kanban con 'Cubrir desde -> Campo de activo' habilitado. El c\u00f3digo vulnerable acepta URLs HTTP(s) arbitrarias sin extensiones como im\u00e1genes, almacena la cadena controlada por el atacante en 'coverURL' y la inyecta directamente en un atributo '<img src=\"...\"> sin escapar. En el cliente de escritorio Electron, el JavaScript inyectado se ejecuta con 'nodeIntegration' habilitado y 'contextIsolation' deshabilitado, por lo que el XSS alcanza la ejecuci\u00f3n arbitraria de comandos del sistema operativo bajo la cuenta de la v\u00edctima. Este problema ha sido parcheado en la versi\u00f3n 3.6.2."}], "id": "CVE-2026-34448", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34448", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-03T16:04:30.231225Z", "version": "2.0.3"}}]}, "published": "2026-03-31T22:16:19.657", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/siyuan-note/siyuan/issues/17246"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rx4h-526q-4458"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.6.2)"}}], "enrichment": {"confidence": 84.0, "confidence_source": "matching", "scores": [{"score": 84.0, "source": "matching"}]}, "original": {"product": "siyuan", "source": "cna", "vendor": "siyuan-note"}, "product": "siyuan", "vendor": "siyuan"}], "analysis": {"en": {"generated_at": "2026-04-03T20:24:22.579766+00:00", "value": {"mitigation_remediation": ["Upgrade Siyuan to version 3.6.2 or later to apply the vendor patch.", "If an upgrade cannot be performed immediately, disable the Gallery or Kanban cover feature or restrict the use of external URLs in the Asset Field to prevent the injected script from executing.", "Monitor user accounts for unexpected command execution or abnormal activity, and review logs for signs of remote code execution."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary OS Command Execution"}, "threat_synthesis": {"affected_systems": "Affecting all versions of the Siyuan personal knowledge\u2011management system released prior to 3.6.2, the issue is present for users who run the Electron desktop client. The vulnerability specifically targets the gallery and kanban view rendering when the cover is sourced from an asset field. Users of personnel or organizations relying on Siyuan for note\u2011keeping or task management are susceptible unless they are on the patched release.", "description_and_impact": "The vulnerability is a stored cross\u2011site scripting flaw in Siyuan\u2019s Attribute View rendering. An attacker can place a crafted HTTP or HTTPS URL lacking an extension in an Attribute View\u2019s \u2018mAsse\u2019 field. When a user opens a Gallery or Kanban view that uses \u2018Cover From \u2192 Asset Field\u2019, the application stores this URL in the coverURL field and injects it directly into an <img src=\"...\"> element without escaping. Because the Electron desktop client runs with nodeIntegration enabled and contextIsolation disabled, the injected script runs with Node.js privileges, allowing the attacker to execute arbitrary operating\u2011system commands under the victim\u2019s user account. The flaw arises from CWE\u201179 (Stored Cross\u2011Site Scripting) and CWE\u201194 (Code Injection).", "risk_and_exploitability": "With a CVSS v3.1 score of 9.1, the vulnerability carries a high severity rating, indicating a full compromise of the victim\u2019s operating system. EPSS shows a low exploitation likelihood (<1\u202f%), suggesting that the attack is more likely to be targeted rather than widespread. The problem is not yet listed in the CISA KEV catalog, but its impact is severe for any user who can manipulate attribute fields. Attackers would need to inject malicious URLs into the data and convince a victim to open a gallery or kanban view with the problematic cover option; no network\u2011side control is required beyond the initial data compromise. Once exploited, the attacker gains complete control of the host machine."}}}}, "created": "2026-04-02T07:52:03.942279+00:00", "updated": "2026-04-03T21:17:26.737188+00:00", "vendors": ["siyuan", "siyuan$PRODUCT$siyuan"]}