Siyuan Note: Eight Vulnerabilities Including RCE and Auth Bypass Disclosed Together
Key findings • Eight vulnerabilities in Siyuan Note prior to v3.7.0 disclosed on June 24, 2026. • Multiple Stored XSS vulnerabilities escalate to RCE in the Electron client. • Unauthentic…
Key findings
- Eight vulnerabilities in Siyuan Note prior to v3.7.0 disclosed on June 24, 2026.
- Multiple Stored XSS vulnerabilities escalate to RCE in the Electron client.
- Unauthenticated Admin API access and SQLite data exfiltration are possible.
- Path traversal vulnerability allows arbitrary file reads in publish mode.
- All issues addressed in Siyuan Note version 3.7.0.
On June 24, 2026, a batch of eight vulnerabilities was disclosed for Siyuan Note, an open-source personal knowledge management system. These vulnerabilities, all affecting versions prior to 3.7.0, were published together and highlight significant security weaknesses, including multiple paths to Remote Code Execution (RCE) and unauthenticated API access. The disclosures collectively underscore the importance of updating Siyuan Note to version 3.7.0 or later to mitigate these risks.
Several vulnerabilities leverage Stored Cross-Site Scripting (XSS) to achieve RCE, particularly within the Electron desktop client. CVE-2026-55570, for instance, exploits unescaped data-obj attributes in the Siyuan marketplace, bypassing a previous patch. Similarly, CVE-2026-50551 and CVE-2026-54158 involve stored XSS in the attribute view's cell rendering, allowing arbitrary JavaScript execution that can escalate to RCE. CVE-2026-54067 further demonstrates this pattern, enabling RCE via CSS snippet breakouts in the renderSnippet() function.
Another critical vulnerability, CVE-2026-54759, allows arbitrary command execution through the inclusion of malicious <iframe> tags in Bazaar package README files. This is possible because Siyuan's Lute HTML sanitizer does not adequately remove <iframe> elements, and the Electron client has a permissive security configuration.
Beyond RCE, unauthenticated access to sensitive administrative functions and data exfiltration are also possible. CVE-2026-54069 permits unauthenticated access to the Admin API by unconditionally trusting all chrome-extension:// origins, effectively granting administrator privileges to any installed browser extension. Additionally, CVE-2026-54066 details how an unauthenticated user can exfiltrate SQLite data via template injection in the /api/icon/getDynamicIcon endpoint, which is explicitly excluded from authentication checks.
Path traversal is also a concern, as demonstrated by CVE-2026-54066. This vulnerability, a regression from a previous fix, allows arbitrary file reads in publish mode through double URL encoding in the /assets/*path route.
All eight vulnerabilities were fixed in Siyuan Note version 3.7.0. Users are strongly advised to update to this version to protect against these security risks. The coordinated disclosure of these vulnerabilities highlights a critical need for users to maintain up-to-date software to prevent potential exploitation.
The clustered nature of these disclosures, all published on the same day, suggests a thorough security audit or a coordinated bug bounty payout. Users should remain vigilant for any further security advisories related to Siyuan Note and ensure their systems are patched promptly. The potential for RCE and data exfiltration makes these vulnerabilities particularly severe for users relying on Siyuan Note for sensitive information management.