Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-50551.
Upgrade to ProDetect SiYuan Attribute View Asset Cell Stored XSS to RCE (CVE-2026-50551) in CrowdStrike LogScale
Detects exploitation of CVE-2026-50551, a stored Cross-Site Scripting (CWE-79) vulnerability in SiYuan (github.com/siyuan-note/siyuan/kernel) affecting versions prior to 0.0.0-20260628153353-2d5d72223df4. Unsanitized attribute view asset cell content allows an attacker to inject malicious script/HTML that executes in the context of the SiYuan kernel's rendering surface, which can be chained with SiYuan's local kernel API and plugin/asset execution surfaces to achieve remote code execution. Detection focuses on suspicious payloads written into attribute view (database) asset cell fields, anomalous kernel HTTP API calls consistent with XSS-to-RCE chaining, and post-exploitation process/file activity on hosts running the SiYuan kernel service.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName=HttpRequest
| RequestURI=/.*\/api\/(av|attributeView|asset)\/.*/i
| RequestBody=/(?i)(<script|onerror=|onload=|javascript:|document\.cookie|eval\()/
| join(query={#event_simpleName=ProcessRollup2 | CommandLine=/(?i)(curl|wget|powershell|bash -c|reverse)/}, field=[aid], key=[aid], mode=inner)
| table([timestamp, ComputerName, RequestURI, RequestBody, CommandLine])
| sort(timestamp, order=desc)CrowdStrike Falcon query correlating suspicious XSS-laden HTTP requests to SiYuan kernel attribute view/asset endpoints with subsequent suspicious command execution on the same agent, indicating CVE-2026-50551 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Unrelated process launches on the same host occurring near the flagged request
- Internal security testing generating both HTTP and process telemetry
- Proxy/EDR sensor gaps causing partial or misattributed joins
Other platforms for CVE-2026-50551
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Inject stored XSS payload into SiYuan attribute view asset cell
Expected signal: HTTP POST request to /api/av/setAttributeViewCell containing an <img onerror=...> payload in RequestBody, logged in proxy/access logs.
- Test 2Render malicious attribute view cell to trigger stored XSS
Expected signal: Kernel API request to render the attribute view; if a headless/WebView renderer is used, outbound network telemetry to attacker.example may be observed.
- Test 3Simulate XSS-to-RCE chain via local plugin/script execution
Expected signal: Process creation event for bash/curl spawned in close temporal proximity to the SiYuan kernel process, plus a network connection attempt to an external/test host.
- Test 4Windows lab validation of downstream process spawn after payload render
Expected signal: Sysmon Event ID 1 (Process Creation) for powershell.exe with a benign command line, occurring shortly after a simulated attribute view API request.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-50551 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month