CVE-2026-34449 SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection
Attackers can achieve remote code execution on SiYuan desktop via JavaScript injection exploiting permissive CORS policies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-34449?
CVE-2026-34449 is a critical code injection vulnerability in B3log Siyuan, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (Access-Control-Allow-Origin: * + Access-Control-Allow-Private-Network: true) to inject a JavaScript snippet via the API. The injected snippet executes in Electron's Node.js context with full OS access the next time the user opens SiYuan's UI. No user interaction is required beyond visiting the malicious website while SiYuan is running. This issue has been patched in version 3.6.2.
Weakness: CWE-942
Which versions are affected by CVE-2026-34449?
3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/siyuan-note/siyuan/kernel Go | All versions | None |
github.com/siyuan-note/siyuan/kernel Go | All versions | 3.6.2 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 3.6.2 |
Products include B3log Siyuan.
How do I fix CVE-2026-34449?
Upgrade github.com/siyuan-note/siyuan/kernel to 3.6.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-34449 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34449 exists.
Other vulnerabilities in B3log Siyuan
- CVE-2026-32938 SiYuan has an Arbitrary File Read in its Desktop Publish Service
- CVE-2026-33669 SiYuan has Arbitrary Document Reading within the Publishing Service
- CVE-2026-33670 SiYuan has directory traversal within its publishing service
- CVE-2026-32767 SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API
- CVE-2024-53504 SQL injection in n/a
Sources
Also known as GHSA-68p4-j234-43mv, GO-2026-5171.