CVE-2026-55570

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.0

Description SiYuan fails to escape untrusted fields including name, version, author, and description when they are serialized into the data-obj HTML attribute of marketplace cards. Since the attribute uses single quotes and the value is generated via JSON.stringify(), which does not escape single quotes, less-than signs, or greater-than signs, a package name containing a single quote can break the attribute boundary to inject arbitrary HTML. In the desktop client, the main BrowserWindow is configured with nodeIntegration: true and contextIsolation: false, allowing the injected markup to escalate from DOM XSS (Cross-Site Scripting) to arbitrary OS command execution.

Recommendations Update to version 3.7.0.