CVE-2026-59833: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in siyuan-note siyuan
SiYuan, an open-source personal knowledge management system, has a stored cross-site scripting (XSS) vulnerability in versions prior to 3.7.1. The vulnerability arises because the Lute engine used for rendering note and package content to HTML does not properly sanitize certain attributes, such as form action and SVG xlink:href. This allows malicious scripts embedded in document export-preview and Bazaar package README render paths to execute OS commands within the Electron desktop renderer. The issue is fixed in version 3.7.1.
AI Analysis
Technical Summary
CVE-2026-59833 is a stored cross-site scripting vulnerability in SiYuan prior to version 3.7.1. The Lute rendering engine, despite having sanitization enabled, fails to check dangerous JavaScript schemes in form action and SVG xlink:href attributes. This flaw allows attackers to inject scripts that execute OS commands in the Electron desktop environment when rendering exported documents or Bazaar package README files. The vulnerability is addressed by the vendor in SiYuan version 3.7.1.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary OS commands on the victim's machine through the Electron desktop renderer by injecting malicious scripts in exported documents or package README files. This can lead to compromise of the user's system and data. The CVSS 4.0 score is 8.6 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix is available in SiYuan version 3.7.1. Users should upgrade to version 3.7.1 or later to remediate this vulnerability. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor advisory stating the issue is fixed in 3.7.1.
CVE-2026-59833: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in siyuan-note siyuan
Description
SiYuan, an open-source personal knowledge management system, has a stored cross-site scripting (XSS) vulnerability in versions prior to 3.7.1. The vulnerability arises because the Lute engine used for rendering note and package content to HTML does not properly sanitize certain attributes, such as form action and SVG xlink:href. This allows malicious scripts embedded in document export-preview and Bazaar package README render paths to execute OS commands within the Electron desktop renderer. The issue is fixed in version 3.7.1.
CVSS v4.0
Score 8.6high
Affected software
pkg:github/siyuan-note/siyuanRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-59833 is a stored cross-site scripting vulnerability in SiYuan prior to version 3.7.1. The Lute rendering engine, despite having sanitization enabled, fails to check dangerous JavaScript schemes in form action and SVG xlink:href attributes. This flaw allows attackers to inject scripts that execute OS commands in the Electron desktop environment when rendering exported documents or Bazaar package README files. The vulnerability is addressed by the vendor in SiYuan version 3.7.1.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary OS commands on the victim's machine through the Electron desktop renderer by injecting malicious scripts in exported documents or package README files. This can lead to compromise of the user's system and data. The CVSS 4.0 score is 8.6 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix is available in SiYuan version 3.7.1. Users should upgrade to version 3.7.1 or later to remediate this vulnerability. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor advisory stating the issue is fixed in 3.7.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-07T15:00:50.979Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a50252a68715ace43310cdf
Added to database: 07/09/2026, 22:48:10 UTC
Last enriched: 07/09/2026, 23:02:38 UTC
Last updated: 07/09/2026, 23:21:16 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.