CVE-2026-55570

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape the untrusted fields (name, version, author, description) when they are serialized into the data-obj HTML attribute of each marketplace card. Because the attribute is single-quoted and the value is produced with JSON.stringify() (which does not escape ', <, or >), a package whose name contains a single quote breaks out of the attribute and injects arbitrary HTML. In the desktop client the main BrowserWindow runs with nodeIntegration: true, contextIsolation: false, so the injected markup escalates from DOM XSS to arbitrary OS command execution. This is the same root cause and same impact as the original advisory, reached through a sibling sink the patch did not cover. This vulnerability is fixed in 3.7.0.

• CWE-79
• CWE-94
• CWE-116

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x88j-wgpr-h22x
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x88j-wgpr-h22x

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55550NextCRM is open-source customer relationship management (CRM…7.1
• CVE-2026-55554Dompdf is an HTML to PDF converter for PHP. In versions 3.15…7.5
• CVE-2026-55555Dompdf is an HTML to PDF converter for PHP. Versions 3.15 an…7.5
• CVE-2026-5556A security vulnerability has been detected in badlogic pi-mo…6.3
• CVE-2026-55568Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in…5.9
• CVE-2026-5557A vulnerability was detected in badlogic pi-mono up to 0.58.…6.3
• CVE-2026-55574vLLM is a high-throughput and memory-efficient inference and…7.5
• CVE-2026-55575LiquidJS is a Shopify / GitHub Pages compatible template eng…8.2
• CVE-2026-55576MaaAssistantArknights is a one-click tool for daily Arknight…8.8
• CVE-2026-55577ImageMagick is free and open-source software used for editin…5.9
• CVE-2026-55578Pheditor is a single-file editor and file manager written in…8.8
• CVE-2026-55579Pheditor is a single-file editor and file manager written in…9.8