Log in Start free

Vulnerability · Published Apr 16, 2026 · Assigned by GitHub_M

CVE-2026-40922SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)

Medium 5.3

In plain English

A medium-severity cross-site scripting in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.3%top 82.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

SiYuan is an open-source personal knowledge management system. In versions 3.6.1 through 3.6.3, a prior fix for XSS in bazaar README rendering (incomplete fix for CVE-2026-33066) enabled the Lute HTML sanitizer, but the sanitizer does not block iframe tags, and its URL-prefix blocklist does not effectively filter srcdoc attributes which contain raw HTML rather than URLs. A malicious bazaar package author can include an iframe with a srcdoc attribute containing embedded scripts in their README. When other users view the package in SiYuan's marketplace UI, the payload executes in the Electron context with full application privileges, enabling arbitrary code execution on the user's machine. This issue has been fixed in version 3.6.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/siyuan-note/siyuan/kernel0.0.0-20260414013942-62eed37a3263GHSA-8q5w-mmxf-48jg
Gogithub.com/siyuan-note/siyuan/kernel0.0.0-20260414013942-62eed37a3263GO-2026-5260

Affected products (as reported)

VendorProductVersions
siyuan-note siyuan < 3.6.4

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References