RCE in B3log Siyuan
CVE-2026-34585
SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side attribute escaping when an HTML entity is mixed with raw special characters. An attacker can embed a malicious IAL value inside a .sy document, package it as a .sy.zip, and have the victim import it through the normal Import -> SiYuan .sy.zip workflow. Once the note is opened, the malicious attribute breaks out of its original HTML context and injects an event handler, resulting in stored XSS. In the Electron desktop client, this XSS reaches remote code execution because injected JavaScript runs with access to Node/Electron APIs. This issue has been patched in version 3.6.2.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (27.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 27.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.000
Affected products
- B3log Siyuan
- Siyuan-Note Siyuan — versions < 3.6.2
Weakness classification (CWE)
References
- github.com/siyuan-note/siyuan/security/advisories/GHSA-ff66-236v-p4fg (Exploit, Vendor Advisory)
- github.com/siyuan-note/siyuan/issues/17246 (Issue Tracking)
- github.com/siyuan-note/siyuan/releases/tag/v3.6.2 (Release Notes)
Frequently asked questions
- What is CVE-2026-34585?
- CVE-2026-34585 is a high-severity vulnerability in B3log Siyuan, classified under Cross-site Scripting. CVSS score: 8.6/10. Published 2026-03-31.
- How severe is CVE-2026-34585?
- High severity. CVSS v3 base score is 8.6 out of 10.