Critical severity9.9NVD Advisory· Published Jun 24, 2026· Updated Jun 25, 2026

CVE-2026-50551

Description

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/siyuan-note/siyuan/kernelGo	< 0.0.0-20260628153353-2d5d72223df4	0.0.0-20260628153353-2d5d72223df4

Affected products

Siyuan Note/Siyuanllm-fuzzy
Range: <3.7.0
osv-coords
pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
Range: < 0.0.20260723T184607-160000.1.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-56mp-4f3v-fgj2ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-50551ghsaADVISORY
github.com/siyuan-note/siyuan/security/advisories/GHSA-56mp-4f3v-fgj2nvdWEB

News mentions

Siyuan Note: Eight Vulnerabilities Including RCE and Auth Bypass Disclosed Together
Vypr Intelligence · Jun 24, 2026

cvss	0.643
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000