PT-2026-35065 · Siyuan · Siyuan

Published 2026-04-24 · Updated 2026-04-24 · CVE-2026-41421

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.6.5

Description SiYuan desktop renders notification messages as raw HTML within an Electron renderer. The API endpoint '/api/notification/pushMsg' accepts a user-controlled msg value, which is forwarded through the backend broadcast layer and inserted into the DOM using the insertAdjacentHTML() function in message.ts. Because Electron windows are configured with nodeIntegration: true, contextIsolation: false, and webSecurity: false in main.js, JavaScript executed via this sink can access Node APIs, leading to desktop code execution.

Recommendations Update to version 3.6.5.

Exploit

Fix

OS Command Injection

XSS

Weakness Enumeration

CWE-78

CWE-79

Related Identifiers

CVE-2026-41421

Affected Products

Siyuan

References · 3

• 🔥 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-grjj-6f6g-cq8q · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41421 · Security Note
• https://twitter.com/CVEnew/status/2047798571257463260 · Twitter Post