CVE-2026-55570
Received Received - Intake
DOM XSS in SiYuan Personal Knowledge Management System

Publication date: 2026-06-24

Last updated on: 2026-06-24

Assigner: GitHub, Inc.

Description
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape the untrusted fields (name, version, author, description) when they are serialized into the data-obj HTML attribute of each marketplace card. Because the attribute is single-quoted and the value is produced with JSON.stringify() (which does not escape ', <, or >), a package whose name contains a single quote breaks out of the attribute and injects arbitrary HTML. In the desktop client the main BrowserWindow runs with nodeIntegration: true, contextIsolation: false, so the injected markup escalates from DOM XSS to arbitrary OS command execution. This is the same root cause and same impact as the original advisory, reached through a sibling sink the patch did not cover. This vulnerability is fixed in 3.7.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-24
Last Modified
2026-06-24
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-55570
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in SiYuan, an open-source personal knowledge management system, in versions prior to 3.7.0. The issue arises because untrusted fields such as name, version, author, and description are not properly escaped when serialized into the data-obj HTML attribute of each marketplace card.

The data-obj attribute is single-quoted, and the value is produced using JSON.stringify(), which does not escape certain characters like single quotes, less than, or greater than signs. If a package name contains a single quote, it can break out of the attribute and inject arbitrary HTML.

In the desktop client, the main BrowserWindow runs with nodeIntegration enabled and contextIsolation disabled, which allows this injected markup to escalate from a DOM-based cross-site scripting (XSS) vulnerability to arbitrary operating system command execution.

This vulnerability was fixed in version 3.7.0.

Impact Analysis

This vulnerability can have severe impacts because it allows an attacker to inject arbitrary HTML and escalate that to arbitrary OS command execution on the affected system.

An attacker could exploit this to execute malicious commands on the user's operating system, potentially leading to full system compromise, data theft, or other malicious activities.

The CVSS v3.1 base score of 9.0 reflects the high severity, indicating network attack vector, low attack complexity, requiring privileges and user interaction, but with scope change and high impact on confidentiality, integrity, and availability.

Mitigation Strategies

The vulnerability is fixed in SiYuan version 3.7.0. The immediate step to mitigate this vulnerability is to upgrade the SiYuan personal knowledge management system to version 3.7.0 or later.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55570. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart