CVE-2026-54759

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, Lute's HTML sanitizer does not remove <iframe> elements. Combined with the SiYuan Electron client's permissive security configuration, an attacker can include a malicious <iframe> in a Bazaar package README that executes arbitrary commands on the victim's machine when the package details are viewed. No package installation is required. This vulnerability is fixed in 3.7.0.

• CWE-79

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-r6v5-4c66-f6pw
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-r6v5-4c66-f6pw

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54753Nx is a monorepo solution for TypeScript and polyglot codeba…5.9
• CVE-2026-54754Klever-Go is the Go implementation of the Klever blockchain …9.6
• CVE-2026-54755Klever-Go is the Go implementation of the Klever blockchain …9.6
• CVE-2026-54756Jodit Editor is a WYSIWYG editor with written in pure TypeSc…6.3
• CVE-2026-54757Compliance-trestle (Trestle) is a Python SDK and command-lin…7.8
• CVE-2026-54758Notepad++ is a free and open-source source code editor. Prio…7.8
• CVE-2026-5476A vulnerability was identified in NASA cFS up to 7.0.0 on 32…4.6
• CVE-2026-54760Langroid is a framework for building large-language-model-po…9.3
• CVE-2026-54761Traefik is an HTTP reverse proxy and load balancer. Prior to…7.1
• CVE-2026-54762Traefik is an HTTP reverse proxy and load balancer. From 3.7…8.6
• CVE-2026-54763Traefik is an HTTP reverse proxy and load balancer. Prior to…10
• CVE-2026-54764Traefik is an HTTP reverse proxy and load balancer. Prior to…5.8