CVE-2026-54158

{"id": "CVE-2026-54158", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54158", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-25T23:11:44.806060Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "siyuan-note", "product": "siyuan", "versions": [{"status": "affected", "version": "< 3.7.0"}]}]}], "published": "2026-06-24T22:16:48.740", "references": [{"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5xfx-xj4h-5p7r", "source": "security-advisories@github.com"}, {"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5xfx-xj4h-5p7r", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (database) cell renderer genAVValueHTML interpolates cell content raw in four of its branches: text, url, phone, and mAsset. A cell value like </textarea><img src=x onerror=\"...\"> or \"><img src=x onerror=\"...\"> breaks out of its surrounding tag and runs arbitrary JavaScript in the renderer when the victim opens the block-attribute panel. On Electron desktop the renderer runs with nodeIntegration:true, so the XSS chains to host RCE via require('child_process'). AV files live under the workspace and ride normal sync, so an attacker with write access to any synced workspace plants the payload once and it fires on every device that opens a panel containing that row.he kernel doesn't escape on the way in either, so the malicious cell persists byte-for-byte. There's no equivalent of the html.EscapeAttrVal call that protects block IAL attributes at kernel/model/blockial.go:261. This vulnerability is fixed in 3.7.0."}, {"lang": "es", "value": "SiYuan es un sistema de gesti\u00f3n de conocimiento personal de c\u00f3digo abierto. Antes de la versi\u00f3n 3.7.0, el renderizador de celdas genAVValueHTML de la vista de atributos (base de datos) interpola el contenido de la celda en bruto en cuatro de sus ramas: texto, url, tel\u00e9fono y mAsset. Un valor de celda como </textarea [tag_HTML_PoC] o \u2019 [tag_HTML_PoC] \u2019 escapa de su etiqueta circundante y ejecuta JavaScript arbitrario en el renderizador cuando la v\u00edctima abre el panel de atributos de bloque. En el escritorio de Electron, el renderizador se ejecuta con nodeIntegration:true, por lo que el XSS se encadena a RCE en el host a trav\u00e9s de require(\u2019child_process\u2019). Los archivos AV residen en el espacio de trabajo y se sincronizan normalmente, por lo que un atacante con acceso de escritura a cualquier espacio de trabajo sincronizado implanta la carga \u00fatil una vez y se activa en cada dispositivo que abre un panel que contiene esa fila. El kernel tampoco escapa al entrar, por lo que la celda maliciosa persiste byte a byte. No existe un equivalente de la llamada html.EscapeAttrVal que protege los atributos IAL de bloque en kernel/model/blockial.go:261. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 3.7.0."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security-advisories@github.com"}