External risk intelligence

SiYuan Stored XSS in Attribute View Escalates to RCE in Electron Client

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-50551

SiYuan is a personal knowledge management system designed as a desktop application. It is typically deployed as a local client-side tool for individual use rather than an internet-facing service, web gateway, or public-facing API endpoint.

Cross-site Scripting

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in SiYuan, an open-source personal knowledge management system, affecting its desktop client. This flaw could allow for the execution of malicious code on a user's system. The primary concern at this time is to determine if this technology is in use within our environment.

Stored flaw allows remote code execution.
Confirming relevance and exposure is the main concern.
Assess use of SiYuan knowledge management system.

Attack Path

How an attacker could exploit the issue

An attacker with low privileges could potentially exploit this vulnerability by injecting malicious code through the Attribute View feature. This code could then be executed on the Electron desktop client, leading to remote code execution.

Requires authenticated access.
Malicious code injected into Attribute View.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, the SiYuan Electron desktop client could be at risk of remote code execution due to a stored cross-site scripting vulnerability in the Attribute View. This could affect the integrity and confidentiality of user data and system operations.

User data and system integrity.
Via crafted attributes in the Attribute View.
Remote code execution on the client.

Operational Fix

Recommended remediation, mitigation, and detection steps

The SiYuan application, particularly its Electron desktop client, requires attention due to a stored cross-site scripting vulnerability that can lead to remote code execution. The first practical step is to identify all instances of SiYuan, confirm if they are internet-reachable or business-critical, and then locate the accountable owner for remediation planning. Coordination with the vendor for updates is also a crucial early action.

Application owners should manage the issue.
Verify Electron client reachability and criticality.
Plan vendor-coordinated updates or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the SiYuan software?

SiYuan is an open-source personal knowledge management system that helps users organize information, notes, and databases. It is built as a desktop application using the Electron framework, which allows web technologies to run as local software on your computer.

How does CVE-2026-50551 create a security risk?

This vulnerability is a Stored Cross-Site Scripting (XSS) issue, categorized as CWE-79. In this case, the software fails to properly sanitize input in its Attribute View. Because the application runs on Electron, this flaw allows an attacker to elevate the script execution into full remote code execution on the user's local machine.

Do I need to be logged in to trigger this vulnerability?

Yes, exploiting this requires an attacker to have low-privileged access to the system, as they must be able to interact with the Attribute View feature to inject the malicious code. Simply viewing a page without authorization or performing routine tasks that do not involve data entry in the Attribute View does not trigger the bug.

Is my SiYuan installation likely to be exposed to this?

According to Halo Surface Signal, it is very unlikely. SiYuan is typically deployed as a local client-side tool for individual use, rather than an internet-facing service or public-facing API. Unless you have specifically configured your local desktop instance to be accessible over the network, the risk of external exploitation is minimal.

How should I address this CVE-2026-50551 vulnerability?

The most effective way to secure your system is to update your software to version 3.7.0 or later, where this issue has been resolved. First, identify any active installations of SiYuan on your local systems, confirm the current version number, and coordinate with the vendor or application owner to apply the necessary update.

References

github.com/siyuan-note/siyuan/security/advisories/GHSA-56mp-4f3v…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.