CVE-2026-40922 SiYuan has incomplete fix for CVE-2026-33066: XSS
A stored XSS vulnerability in SiYuan allows malicious bazaar package authors to execute arbitrary code on users' machines via iframe srcdoc payloads.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40922?
CVE-2026-40922 is a medium-severity cross-site scripting vulnerability in B3log Siyuan, published on 16 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SiYuan is an open-source personal knowledge management system. In versions 3.6.1 through 3.6.3, a prior fix for XSS in bazaar README rendering (incomplete fix for CVE-2026-33066) enabled the Lute HTML sanitizer, but the sanitizer does not block iframe tags, and its URL-prefix blocklist does not effectively filter srcdoc attributes which contain raw HTML rather than URLs. A malicious bazaar package author can include an iframe with a srcdoc attribute containing embedded scripts in their README. When other users view the package in SiYuan's marketplace UI, the payload executes in the Electron context with full application privileges, enabling arbitrary code execution on the user's machine. This issue has been fixed in version 3.6.4.
Weakness: CWE-79
Which versions are affected by CVE-2026-40922?
3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260414013942-62eed37a3263 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260414013942-62eed37a3263 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260414013942-62eed37a3263 |
Products include B3log Siyuan.
How do I fix CVE-2026-40922?
Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260414013942-62eed37a3263 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-40922 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40922 exists.
Other vulnerabilities in B3log Siyuan
- CVE-2026-32938 SiYuan has an Arbitrary File Read in its Desktop Publish Service
- CVE-2026-33669 SiYuan has Arbitrary Document Reading within the Publishing Service
- CVE-2026-33670 SiYuan has directory traversal within its publishing service
- CVE-2026-32767 SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API
- CVE-2024-53504 SQL injection in n/a
Sources
Also known as GHSA-8q5w-mmxf-48jg, GO-2026-5260.