PT-2026-41017 · Siyuan · Siyuan

Shmulc8 · CVE-2026-44586 · Published 2026-05-14 · Updated 2026-05-14

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiYuan versions 2.1.12 through 3.6.x

Description The Bazaar marketplace renders package author metadata from the public bazaar stage feed into HTML without proper escaping. In the desktop application, this leads to stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the server and served to users. Due to the Electron windows being configured with nodeIntegration: true and contextIsolation: false, an attacker can leverage a successful payload to call Node.js APIs and execute arbitrary code on the host system.

Recommendations Update to version 3.7.0.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-44586

GHSA-X6WF-W2RG-2GW9

Affected Products

Siyuan

References · 4

• 🔥 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x6wf-w2rg-2gw9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44586.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44586 · Security Note
• https://osv.dev/vulnerability/CVE-2026-44586 · Vendor Advisory