PT-2026-52104 · Siyuan · Siyuan

CVE-2026-50551

·

Published

2026-06-24

·

Updated

2026-07-30

CVSS v3.1

9.9

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.0
Description Stored cross-site scripting (XSS) exists in the Attribute View (database) asset cell renderer. This issue can escalate to remote code execution (RCE) within the Electron desktop client. XSS is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users, while RCE allows an attacker to execute arbitrary commands on the target machine.
Recommendations Update to version 3.7.0.

Exploit

Fix

RCE

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-50551
GHSA-56MP-4F3V-FGJ2
GO-2026-5967
OPENSUSE-SU-2026:21483-1

Affected Products

Siyuan