PT-2026-33374 · Siyuan · Siyuan

Published 2026-04-16 · Updated 2026-04-18 · CVE-2026-40322

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.6.4

Description Mermaid diagrams are rendered with the securityLevel set to "loose", and the resulting SVG is injected into the DOM via innerHTML. This allows attacker-controlled javascript: URLs in Mermaid code blocks to be included in the rendered output. In desktop builds using Electron, windows are created with nodeIntegration enabled and contextIsolation disabled, which allows a stored cross-site scripting (XSS) attack to escalate to arbitrary code execution when a user opens a note containing a malicious Mermaid block and clicks the rendered diagram node.

Recommendations Update to version 3.6.4.

Exploit

Fix

RCE

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-40322

Affected Products

Siyuan

References · 6

• 🔥 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x63q-3rcj-hhp5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40322 · Security Note
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4 · Note
• https://twitter.com/0dayPublishing/status/2044916172877897903 · Twitter Post
• https://twitter.com/vuldb/status/2045297304903807221 · Twitter Post
• https://twitter.com/CVEnew/status/2045102632432275615 · Twitter Post