CVE-2026-34585 - Vulnerability Analysis

Overview

SiYuan < 3.6.2 contains a stored XSS caused by crafted block attribute values bypassing server-side escaping in .sy documents, letting attackers inject event handlers and achieve remote code execution in the Electron client, exploit requires victim to import a malicious .sy.zip file and open the note.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript with Node/Electron API access, leading to remote code execution on the victim's system.

Mitigation

Update to version 3.6.2 or later.

References

• https://github.com/siyuan-note/siyuan/issues/17246
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ff66-236v-p4fg

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner