CVE-2026-44586

SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan's Bazaar marketplace renders package author metadata from the public bazaar stage feed into HTML without escaping. In the desktop app this becomes stored XSS, and because SiYuan's Electron windows are created with nodeIntegration: true and contextIsolation: false, a successful payload can call Node.js APIs and execute code on the host. This vulnerability is fixed in 3.7.0.

• CWE-79
• CWE-94

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x6wf-w2rg-2gw9
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x6wf-w2rg-2gw9

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44580Next.js is a React framework for building full-stack web app…6.1
• CVE-2026-44581Next.js is a React framework for building full-stack web app…4.7
• CVE-2026-44582Next.js is a React framework for building full-stack web app…3.7
• CVE-2026-44583Paymenter is a free and open-source webshop solution for man…5.3
• CVE-2026-44584Paymenter is a free and open-source webshop solution for man…4.3
• CVE-2026-44585Paymenter is a free and open-source webshop solution for man…5.4
• CVE-2026-44587CarrierWave is a framework to upload files from Ruby applica…6.1
• CVE-2026-44588SiYuan is an open-source personal knowledge management syste…9.4
• CVE-2026-44589Nuxt OG Image generates OG Images with Vue templates in Nuxt…3.7
• CVE-2026-4459Out of bounds read and write in WebAudio in Google Chrome pr…8.8
• CVE-2026-44590Sherlock hunts down social media accounts by username across…9.3
• CVE-2026-44592Gradient is a nix-based continuous integration system. In 1.…9.4