CVE-2026-50551: SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

July 10, 2026

SiYuan v3.6.5 and earlier versions contain a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This is a neighbor-bug of CVE-2026-44588: the fix for -44588 used escapeAriaLabel() (double-escapes <), but the AV asset renderers were left using the weaker escapeAttr() (escapes only quotes) or no escaping at all.

References

github.com/advisories/GHSA-56mp-4f3v-fgj2
github.com/siyuan-note/siyuan/security/advisories/GHSA-56mp-4f3v-fgj2
nvd.nist.gov/vuln/detail/CVE-2026-50551

Code Behaviors & Features

Detect and mitigate CVE-2026-50551 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →