CVE-2026-44670

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View (AV / database) names without any HTML escape, then a render template uses raw strings.ReplaceAll(tpl, "${avName}", nodeAvName) to embed the name in HTML before pushing to all clients via WebSocket. Three independent client paths (render.ts:120 → outerHTML, Title.ts:401 → innerHTML, transaction.ts:559 → innerHTML) consume the value without escaping. Because the main BrowserWindow runs nodeIntegration:true, contextIsolation:false, webSecurity:false (app/electron/main.js:407-411), HTML injection in the renderer becomes Node.js code execution. This vulnerability is fixed in 3.7.0.

• CWE-79
• CWE-94
• CWE-1188

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h64-c999-c9r6
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h64-c999-c9r6

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44665fast-xml-builder builds XML from JSON. Prior to 1.1.7, when …6.1
• CVE-2026-44666HRConvert2 is a self-hosted, drag-and-drop & nosql file conv…9.3
• CVE-2026-44667FACTION is a PenTesting Report Generation and Collaboration …8.7
• CVE-2026-44668FACTION is a PenTesting Report Generation and Collaboration …9.8
• CVE-2026-44669FACTION is a PenTesting Report Generation and Collaboration …8.7
• CVE-2026-4467A vulnerability was found in Comfast CF-AC100 2.6.0.8. This …4.7
• CVE-2026-44671ZITADEL is an open source identity management platform. From…7.5
• CVE-2026-44672mapfish-print is a component of MapFish for printing templat…9.3
• CVE-2026-44673libyang is a YANG data modeling language library. Prior to S…7.5
• CVE-2026-44678Tuist is a virtual platform team for Swift app devs. In 1.18…7.1
• CVE-2026-44679Tuist is a virtual platform team for Swift app devs. Prior t…6.9
• CVE-2026-4468A vulnerability was determined in Comfast CF-AC100 2.6.0.8. …4.7