CVE-2026-34585

SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side attribute escaping when an HTML entity is mixed with raw special characters. An attacker can embed a malicious IAL value inside a .sy document, package it as a .sy.zip, and have the victim import it through the normal Import -> SiYuan .sy.zip workflow. Once the note is opened, the malicious attribute breaks out of its original HTML context and injects an event handler, resulting in stored XSS. In the Electron desktop client, this XSS reaches remote code execution because injected JavaScript runs with access to Node/Electron APIs. This issue has been patched in version 3.6.2.

• CWE-79
• CWE-94

• https://github.com/siyuan-note/siyuan/issues/17246Issue Tracking
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2Release Notes
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ff66-236v-p4fgExploit, Vendor Advisory
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ff66-236v-p4fgExploit, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34578OPNsense is a FreeBSD based firewall and routing platform. P…8.2
• CVE-2026-34579Mantis Bug Tracker (MantisBT) is an open source issue tracke…5.3
• CVE-2026-34580Botan is a C++ cryptography library. In 3.11.0, the function…7.5
• CVE-2026-34581goshs is a SimpleHTTPServer written in Go. From version 1.1.…8.1
• CVE-2026-34582Botan is a C++ cryptography library. Prior to version 3.11.1…9.1
• CVE-2026-34584listmonk is a standalone, self-hosted, newsletter and mailin…5.4
• CVE-2026-34586PdfDing is a selfhosted PDF manager, viewer and editor offer…6.5
• CVE-2026-34587Kirby is an open-source content management system. Prior to …8.1
• CVE-2026-34588OpenEXR provides the specification and reference implementat…7.8
• CVE-2026-34589OpenEXR provides the specification and reference implementat…5
• CVE-2026-3459The Drag and Drop Multiple File Upload - Contact Form 7 plug…8.1
• CVE-2026-34590Postiz is an AI social media scheduling tool. Prior to versi…5.4