PT-2026-57008 · Siyuan Note · Siyuan

Published 2026-07-09 · Updated 2026-07-09 · CVE-2026-59833

Mitre

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, SiYuan renders note and package content to HTML through the Lute engine with sanitization enabled, but Lute's dangerous javascript scheme block does not check form action or SVG xlink:href attributes, allowing stored cross-site scripting in document export-preview and Bazaar package README render paths that can execute OS commands in the Electron desktop renderer. This issue is fixed in versions 3.7.1.

Fix

Code Injection

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-94

CWE-116

CWE-79

Related Identifiers

CVE-2026-59833

Affected Products

Siyuan

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-59833 · Security Note
• https://github.com/siyuan-note/siyuan/commit/ebe252e61fb93f258d083b9da0fa403679fdf94a · Note
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-97xv-3v84-h358 · Note
• https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1 · Note