CVE-2026-59855: SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/src/asset/index.ts interpolates the unsanitized this.path value into HTML assigne
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/src/asset/index.ts interpolates the unsanitized this.path value into HTML assigned to innerHTML, allowing a crafted asset link containing a double quote to break out of the src attribute, inject an event handler, and execute JavaScript that can run OS commands in the Electron renderer. This issue is fixed in versions 3.7.1-alpha.2 and 3.7.1.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-59855
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-598550.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-59855 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for SiYuan is an
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalGHSA-56mp-4f3v-fgj2: SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Contentghsa · 2026-07-10
- criticalGHSA-5xfx-xj4h-5p7r: SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()ghsa · 2026-07-10
- highGHSA-w7cg-whh7-xp28: SiYuan: Stored XSS in Bazaar marketplace via package README event handlersghsa · 2026-07-10
- criticalGHSA-hvr9-72v2-fff3: SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlistghsa · 2026-07-10
- mediumGHSA-gcm7-57gf-953c: SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getD…ghsa · 2026-07-10
- criticalGHSA-mvjr-vv3c-w4qv: SiYuan: Stored XSS to RCE via CSS-snippet breakout in renderSnippet()ghsa · 2026-07-10
More from NVD Recent CVEs
- lowCVE-2026-61870: ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memo…2026-07-11
- lowCVE-2026-61861: ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption…2026-07-11
- lowCVE-2026-61858: ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and ext…2026-07-11
- lowCVE-2026-61857: ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing nul…2026-07-11
- lowCVE-2026-61465: ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation…2026-07-11