CVE-2026-59833 SiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)
Stored XSS in SiYuan allows attackers to execute OS commands via Electron renderer due to missing URL scheme checks in Lute engine.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-59833?
CVE-2026-59833 is a high-severity cross-site scripting vulnerability in siyuan-note siyuan, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, SiYuan renders note and package content to HTML through the Lute engine with sanitization enabled, but Lute's dangerous javascript scheme block does not check form action or SVG xlink:href attributes, allowing stored cross-site scripting in document export-preview and Bazaar package README render paths that can execute OS commands in the Electron desktop renderer. This issue is fixed in versions 3.7.1.
Which versions are affected by CVE-2026-59833?
How do I fix CVE-2026-59833?
No fix has been published for CVE-2026-59833 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-59833 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59833 exists.
Sources
Also known as GHSA-97xv-3v84-h358.