RCE in Siyuan-note Siyuan

CVE-2026-44670

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View (AV / database) names without any HTML escape, then a render template uses raw strings.ReplaceAll(tpl, "${avName}", nodeAvName)…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.000 (10.1th percentile) — read the EPSS interpretation.