Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-44586

SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan's Bazaar marketplace renders package author metadata from the public bazaar stage feed into HTML without escaping. In the desktop app this becomes stored XSS, and because SiYuan's Electron windows are created with nodeIntegration: true and contextIsolation: false, a successful payload can call Node.js APIs and execute code on the host. This vulnerability is fixed in 3.7.0.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:b3a234a81265b6fa97bde6dd0ab78a6e0ae7459a1a2a832284c174ddc1714fee
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-94","description":"CWE-94: Improper Control of Generation of Code ('Code Injection')","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:0a85a6a017a8392427d6b3e07287301ded97aba02b9318a53025fffc0e1e382f · sha256:0cad2f30777f6a00… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:0a85a6a017a8392427d6b3e07287301ded97aba02b9318a53025fffc0e1e382f · sha256:0cad2f30777f6a00… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion
{"product":"siyuan","vendor":"siyuan-note","versions":[{"status":"affected","version":">= 2.1.12, < 3.7.0"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0a85a6a017a8392427d6b3e07287301ded97aba02b9318a53025fffc0e1e382f · sha256:0cad2f30777f6a00… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:0a85a6a017a8392427d6b3e07287301ded97aba02b9318a53025fffc0e1e382f · sha256:0cad2f30777f6a00… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

2 source assertions
{"cweId":"CWE-94","description":"CWE-94: Improper Control of Generation of Code ('Code Injection')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:0a85a6a017a8392427d6b3e07287301ded97aba02b9318a53025fffc0e1e382f · sha256:0cad2f30777f6a00… · /containers/cna/problemTypes/1/descriptions/0
{"cweId":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:0a85a6a017a8392427d6b3e07287301ded97aba02b9318a53025fffc0e1e382f · sha256:0cad2f30777f6a00… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions
{"name":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x6wf-w2rg-2gw9","tags":["x_refsource_CONFIRM"],"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x6wf-w2rg-2gw9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0a85a6a017a8392427d6b3e07287301ded97aba02b9318a53025fffc0e1e382f · sha256:0cad2f30777f6a00… · /containers/cna/references/0
{"tags":["exploit"],"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x6wf-w2rg-2gw9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0a85a6a017a8392427d6b3e07287301ded97aba02b9318a53025fffc0e1e382f · sha256:0cad2f30777f6a00… · /containers/adp/0/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer