CVE-2026-34448 SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client
Stored XSS in SiYuan desktop client allows arbitrary command execution when viewing malicious asset fields in Gallery or Kanban views.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-34448?
CVE-2026-34448 is a critical cross-site scripting vulnerability in B3log Siyuan, published on 31 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From -> Asset Field” enabled. The vulnerable code accepts arbitrary http(s) URLs without extensions as images, stores the attacker-controlled string in coverURL, and injects it directly into an <img src="..."> attribute without escaping. In the Electron desktop client, the injected JavaScript executes with nodeIntegration enabled and contextIsolation disabled, so the XSS reaches arbitrary OS command execution under the victim’s account. This issue has been patched in version 3.6.2.
Which versions are affected by CVE-2026-34448?
3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/siyuan-note/siyuan/kernel Go | All versions | None |
github.com/siyuan-note/siyuan/kernel Go | All versions | 3.6.2 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 3.6.2 |
Products include B3log Siyuan.
How do I fix CVE-2026-34448?
Upgrade github.com/siyuan-note/siyuan/kernel to 3.6.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-34448 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34448 exists.
Other vulnerabilities in B3log Siyuan
- CVE-2026-32938 SiYuan has an Arbitrary File Read in its Desktop Publish Service
- CVE-2026-33669 SiYuan has Arbitrary Document Reading within the Publishing Service
- CVE-2026-33670 SiYuan has directory traversal within its publishing service
- CVE-2026-32767 SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API
- CVE-2024-53504 SQL injection in n/a
Sources
Also known as GHSA-rx4h-526q-4458, GO-2026-5644.