CVE-2026-54067

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.0

Description A flaw exists where a CSS snippet body containing </style> can break out of its surrounding <style> tag during interpolation by the renderSnippet() function via insertAdjacentHTML. This allows the execution of arbitrary JavaScript in the renderer. In Electron desktop builds, the renderer operates with nodeIntegration:true, enabling access to require('child process') and allowing the cross-site scripting (XSS) to escalate to remote code execution (RCE) on the host. Because snippets synchronize via the workspace repository, an attacker with write access to a synced workspace can deploy the payload to all devices that pull the updates. Additionally, this issue bypasses the separation between enabledCSS and enabledJS, allowing JavaScript execution even when enabledJS is disabled.

Recommendations Update to version 3.7.0.