CVE-2026-50551CWE-79

SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

Critical · published June 24, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
55.3
In the wild
Unconfirmed
What it is

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00776 · 55.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-06-24T21:20Z
EPSS history
Timeline
  • 24 JUN 21:20Z
    SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content
    cvelistv5