CVE-2026-44586: SiYuan Stored XSS Leads to RCE in Desktop App
The National Vulnerability Database has disclosed CVE-2026-44586, a critical vulnerability in SiYuan, an open-source personal knowledge management system. Affecting versions from 2.1.12 to prior to 3.7.0, this flaw stems from improper handling of package author metadata in SiYuan’s Bazaar marketplace. The system renders this data directly into HTML without proper escaping, leading to a stored Cross-Site Scripting (XSS) vulnerability.
For desktop application users, this XSS is particularly dangerous. SiYuan’s Electron windows are configured with nodeIntegration: true and contextIsolation: false. This insecure configuration means a successful XSS payload isn’t just limited to browser-context attacks; it can directly invoke Node.js APIs. The result is arbitrary code execution on the host machine, a full compromise of the user’s system.
With a CVSSv3.1 score of 8.3 (High), this isn’t just a nuisance; it’s a direct path to system takeover. Attackers can leverage this to steal sensitive data, install malware, or establish persistence. Defenders need to understand the implications of Electron apps with weak security configurations — they are often overlooked but present a significant attack surface. The fix is available in SiYuan version 3.7.0.
What This Means For You
- If your organization or team uses SiYuan, check your version immediately. Any SiYuan desktop installations running versions 2.1.12 up to, but not including, 3.7.0 are vulnerable to CVE-2026-44586. Patch to version 3.7.0 or later without delay. The ability for an attacker to run arbitrary code via a simple XSS payload is a red alert.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-44586: SiYuan Bazaar Metadata XSS to RCE via Node.js API Call
title: CVE-2026-44586: SiYuan Bazaar Metadata XSS to RCE via Node.js API Call
id: scw-2026-05-14-ai-1
status: experimental
level: critical
description: |
Detects the execution of Node.js APIs like child_process.exec or fs.writeFileSync within the SiYuan Electron application's process. This is indicative of a Stored XSS vulnerability (CVE-2026-44586) in the Bazaar marketplace where crafted author metadata is rendered as HTML, leading to code execution via Electron's nodeIntegration: true and contextIsolation: false settings.
author: SCW Feed Engine (AI-generated)
date: 2026-05-14
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-44586/
tags:
- attack.execution
- attack.t1059.001
logsource:
category: process_creation
detection:
selection:
Image|startswith:
- 'C:\Program Files\SiYuan\resources\app
ode_modules\electron\dist\electron.exe'
CommandLine|contains:
- 'require("child_process").exec'
- 'require("child_process").spawn'
- 'require("fs").writeFileSync'
- 'require("fs").readFileSync'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-44586 | XSS | SiYuan versions 2.1.12 to before 3.7.0 |
| CVE-2026-44586 | RCE | SiYuan desktop app with nodeIntegration: true and contextIsolation: false |
| CVE-2026-44586 | Code Injection | SiYuan Bazaar marketplace rendering package author metadata |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 14, 2026 at 22:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-6811 — Stack exhaustion vulnerability in the MongoDB PHP driver
CVE-2026-6811 — Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the...
CVE-2026-45248 — The GET /Api/V1/Demo/Registered-Users Endpoint That Authentication Bypass
CVE-2026-45248 — Hedera Guardian through 3.5.1 contains an authentication bypass vulnerability in the GET /api/v1/demo/registered-users endpoint that allows unauthenticated attackers to retrieve sensitive user information....
ZITADEL LDAP Filter Injection Exposes Usernames, Attributes
CVE-2026-44671 — ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was discovered in Zitadel's LDAP identity...