CVE-2026-44586HIGH 8.3EPSS p22.2%

CVE-2026-44586CVE-2026-44586

Description

SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan's Bazaar marketplace renders package author metadata from the public bazaar stage feed into HTML without escaping. In the desktop app this becomes stored XSS, and because SiYuan's Electron windows are created with nodeIntegration: true and contextIsolation: false, a successful payload can call Node.js APIs and execute code on the host. This vulnerability is fixed in 3.7.0.

Scoring

CVSS 3.18.3 (HIGH)
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS0.31% probability of exploitation · percentile 22.2% · 2026-06-19T12:03:05Z
Published2026-05-14
Last modified2026-05-14

Underlying weaknesses· 2

CWE-79CWE-94

References

  1. https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x6wf-w2rg-2gw9
  2. https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x6wf-w2rg-2gw9

2

TypeTargetConfidenceTier
WeaknessImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')cwe-790%live
WeaknessImproper Control of Generation of Code ('Code Injection')cwe-940%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-33067
CVE
CVE-2026-45375
CVE
CVE-2026-41421
CVE
CVE-2026-34585
CVE
CVE-2026-33066
CVE
CVE-2026-34448
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.