CVE-2026-34585

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34585", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T16:56:30.999Z", "datePublished": "2026-03-31T21:47:01.843Z", "dateUpdated": "2026-04-01T13:34:23.291Z"}, "containers": {"cna": {"title": "SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ff66-236v-p4fg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ff66-236v-p4fg"}, {"name": "https://github.com/siyuan-note/siyuan/issues/17246", "tags": ["x_refsource_MISC"], "url": "https://github.com/siyuan-note/siyuan/issues/17246"}, {"name": "https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2"}], "affected": [{"vendor": "siyuan-note", "product": "siyuan", "versions": [{"version": "< 3.6.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T21:47:01.843Z"}, "descriptions": [{"lang": "en", "value": "SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side attribute escaping when an HTML entity is mixed with raw special characters. An attacker can embed a malicious IAL value inside a .sy document, package it as a .sy.zip, and have the victim import it through the normal Import -> SiYuan .sy.zip workflow. Once the note is opened, the malicious attribute breaks out of its original HTML context and injects an event handler, resulting in stored XSS. In the Electron desktop client, this XSS reaches remote code execution because injected JavaScript runs with access to Node/Electron APIs. This issue has been patched in version 3.6.2."}], "source": {"advisory": "GHSA-ff66-236v-p4fg", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ff66-236v-p4fg", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T13:34:18.969599Z", "id": "CVE-2026-34585", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:34:23.291Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34585", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T13:34:18.969599Z"}}}], "references": [{"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ff66-236v-p4fg", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:34:11.964Z"}}], "cna": {"title": "SiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution", "source": {"advisory": "GHSA-ff66-236v-p4fg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "siyuan-note", "product": "siyuan", "versions": [{"status": "affected", "version": "< 3.6.2"}]}], "references": [{"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ff66-236v-p4fg", "name": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ff66-236v-p4fg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/siyuan-note/siyuan/issues/17246", "name": "https://github.com/siyuan-note/siyuan/issues/17246", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2", "name": "https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side attribute escaping when an HTML entity is mixed with raw special characters. An attacker can embed a malicious IAL value inside a .sy document, package it as a .sy.zip, and have the victim import it through the normal Import -> SiYuan .sy.zip workflow. Once the note is opened, the malicious attribute breaks out of its original HTML context and injects an event handler, resulting in stored XSS. In the Electron desktop client, this XSS reaches remote code execution because injected JavaScript runs with access to Node/Electron APIs. This issue has been patched in version 3.6.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T21:47:01.843Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34585", "state": "PUBLISHED", "dateUpdated": "2026-04-01T13:34:23.291Z", "dateReserved": "2026-03-30T16:56:30.999Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-31T21:47:01.843Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "siyuan", "vendor": "siyuan-note", "versions": [{"status": "affected", "version": "< 3.6.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*", "matchCriteriaId": "27CB71A7-7208-417A-AE6D-266D57F683E9", "versionEndExcluding": "3.6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side attribute escaping when an HTML entity is mixed with raw special characters. An attacker can embed a malicious IAL value inside a .sy document, package it as a .sy.zip, and have the victim import it through the normal Import -> SiYuan .sy.zip workflow. Once the note is opened, the malicious attribute breaks out of its original HTML context and injects an event handler, resulting in stored XSS. In the Electron desktop client, this XSS reaches remote code execution because injected JavaScript runs with access to Node/Electron APIs. This issue has been patched in version 3.6.2."}, {"lang": "es", "value": "SiYuan es un sistema de gesti\u00f3n de conocimiento personal. Antes de la versi\u00f3n 3.6.2, una vulnerabilidad permite que valores de atributos de bloque manipulados eludan el escape de atributos del lado del servidor cuando una entidad HTML se mezcla con caracteres especiales sin procesar. Un atacante puede incrustar un valor IAL malicioso dentro de un documento .sy, empaquetarlo como un .sy.zip, y hacer que la v\u00edctima lo importe a trav\u00e9s del flujo de trabajo normal de Importar -&gt; SiYuan .sy.zip. Una vez que se abre la nota, el atributo malicioso sale de su contexto HTML original e inyecta un gestor de eventos, resultando en XSS almacenado. En el cliente de escritorio Electron, este XSS alcanza la ejecuci\u00f3n remota de c\u00f3digo porque el JavaScript inyectado se ejecuta con acceso a las API de Node/Electron. Este problema ha sido parcheado en la versi\u00f3n 3.6.2."}], "id": "CVE-2026-34585", "lastModified": "2026-06-17T10:39:16.763", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34585", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T13:34:18.969599Z", "version": "2.0.3"}}]}, "published": "2026-03-31T22:16:22.080", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/siyuan-note/siyuan/issues/17246"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ff66-236v-p4fg"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ff66-236v-p4fg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.6.2)"}}], "enrichment": {"confidence": 84.0, "confidence_source": "matching", "scores": [{"score": 84.0, "source": "matching"}]}, "original": {"product": "siyuan", "source": "cna", "vendor": "siyuan-note"}, "product": "siyuan", "vendor": "siyuan"}], "analysis": {"en": {"generated_at": "2026-04-03T20:23:55.765539+00:00", "value": {"mitigation_remediation": ["Upgrade Siyuan to version 3.6.2 or later to apply the fix that validates and sanitizes block attribute values.", "If an upgrade is not immediately possible, avoid importing .sy.zip files from untrusted sources or delete any .sy.zip files from the user\u2019s documents folder.", "As a temporary mitigation, consider disabling Node integration in the Electron client or use a sandboxed version of the application if available, though this is not officially supported.", "Verify that the patch has been applied by checking the application version number after restarting the client."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution via stored XSS"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Siyuan note application, version 3.6.1 and earlier, on all operating systems where the Electron desktop client runs. It is relevant to users who use the Import \u2192 SiYuan .sy.zip workflow to bring external notes into their account. The issue does not affect the web or mobile versions, only the desktop Electron build.", "description_and_impact": "SiYuan is a personal knowledge management system that stores documents in .sy format. Prior to release 3.6.2, an attacker can craft a block attribute value that contains a mixed HTML entity and raw special characters. When a victim imports a .sy.zip containing this malicious attribute, the value bypasses server\u2011side escaping, breaks out of its original HTML context and injects an event handler. On the Electron desktop client the injected JavaScript runs with full Node/Electron privileges, allowing the attacker to execute arbitrary system commands. The weakness corresponds to Unvalidated Input and Stored Cross\u2011Site Scripting (CWE\u201179) and code injection (CWE\u201194).", "risk_and_exploitability": "The Common Vulnerability Scoring System assigns a score of 8.6, indicating high severity, and the Exploit Prediction Scoring System shows a probability of less than 1\u00a0%, meaning a real exploitation attack is unlikely to be seen. Because the attack relies on a victim importing a specifically crafted note file, it is primarily a user\u2011interaction attack; a malicious file can be phished or delivered via social engineering to trick the victim into opening it. The vulnerability is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog, further suggesting no publicly available exploit. Nonetheless, users of the affected Electron client should treat this as a critical patch."}}}}, "created": "2026-04-02T07:52:01.729472+00:00", "updated": "2026-04-03T21:17:24.906235+00:00", "vendors": ["siyuan", "siyuan$PRODUCT$siyuan"]}