PT-2026-35065 · Siyuan · Siyuan

CVE-2026-41421 · Published 2026-04-24 · Updated 2026-05-22

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.6.5

Description SiYuan desktop renders notification messages as raw HTML within an Electron renderer. The API endpoint '/api/notification/pushMsg' accepts a user-controlled msg value, which is forwarded through the backend broadcast layer and inserted into the DOM using the insertAdjacentHTML() function in message.ts. Because Electron windows are configured with nodeIntegration: true, contextIsolation: false, and webSecurity: false in main.js, JavaScript executed via this sink can access Node APIs, leading to desktop code execution.

Recommendations Update to version 3.6.5.

Exploit

Fix

RCE

XSS

OS Command Injection

Weakness Enumeration

CWE-79

CWE-78

Related Identifiers

CVE-2026-41421

GHSA-GRJJ-6F6G-CQ8Q

Affected Products

Siyuan

References · 8

• 🔥 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-grjj-6f6g-cq8q · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41421.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-41421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41421 · Security Note
• https://twitter.com/CVEnew/status/2047798571257463260 · Twitter Post
• https://twitter.com/lyrie_ai/status/2057718418824966559 · Twitter Post
• https://twitter.com/lyrie_ai/status/2057718419923841277 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1svdw6f/critical_remote_code_execution_vulnerability · Reddit Post