Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-50551.
Upgrade to ProDetect SiYuan Attribute View Asset Cell Stored XSS to RCE (CVE-2026-50551) in Microsoft Sentinel
Detects exploitation of CVE-2026-50551, a stored Cross-Site Scripting (CWE-79) vulnerability in SiYuan (github.com/siyuan-note/siyuan/kernel) affecting versions prior to 0.0.0-20260628153353-2d5d72223df4. Unsanitized attribute view asset cell content allows an attacker to inject malicious script/HTML that executes in the context of the SiYuan kernel's rendering surface, which can be chained with SiYuan's local kernel API and plugin/asset execution surfaces to achieve remote code execution. Detection focuses on suspicious payloads written into attribute view (database) asset cell fields, anomalous kernel HTTP API calls consistent with XSS-to-RCE chaining, and post-exploitation process/file activity on hosts running the SiYuan kernel service.
MITRE ATT&CK
KQL Detection Query
// Detect suspicious script payloads written to SiYuan attribute view asset cells via kernel API, followed by execution indicators
let suspiciousPatterns = dynamic(["<script","onerror=","onload=","javascript:","<img src=x","document.cookie","fetch(","XMLHttpRequest","eval(","child_process","os/exec","cmd.exe","/bin/sh"]);
let siyuanApiCalls = W3CIISLog
| union (AWSCloudTrail)
| union (Syslog)
| where isnotempty(RequestUrl) or isnotempty(Computer)
| project TimeGenerated, RequestUrl, Computer, csUriStem = coalesce(csUriStem, RequestUrl);
let flaggedRequests = HttpRequest
| where Url has_any ("/api/av/", "/api/attributeView/", "/api/asset/")
| where RequestBody has_any (suspiciousPatterns)
| project TimeGenerated, SourceIP, Url, RequestBody, UserAgent;
flaggedRequests
| join kind=leftouter (
ProcessCreationEvents
| where ProcessCommandLine has_any ("curl", "wget", "powershell", "bash -c", "/bin/sh -c", "nc ", "reverse")
| project TimeGenerated, Computer, ProcessCommandLine
) on $left.TimeGenerated == $right.TimeGenerated
| project TimeGenerated, SourceIP, Url, RequestBody, UserAgent, Computer, ProcessCommandLine
| order by TimeGenerated descFlags HTTP requests to SiYuan kernel attribute view / asset API endpoints containing script injection payloads consistent with CVE-2026-50551, correlated with follow-on process execution on the host.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate use of HTML-like content or code snippets pasted into SiYuan notes by users testing markdown/HTML rendering
- Security scanners/pentest tools probing the API with XSS payloads as part of authorized testing
- Developers debugging attribute view rendering with script-like sample data
Other platforms for CVE-2026-50551
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Inject stored XSS payload into SiYuan attribute view asset cell
Expected signal: HTTP POST request to /api/av/setAttributeViewCell containing an <img onerror=...> payload in RequestBody, logged in proxy/access logs.
- Test 2Render malicious attribute view cell to trigger stored XSS
Expected signal: Kernel API request to render the attribute view; if a headless/WebView renderer is used, outbound network telemetry to attacker.example may be observed.
- Test 3Simulate XSS-to-RCE chain via local plugin/script execution
Expected signal: Process creation event for bash/curl spawned in close temporal proximity to the SiYuan kernel process, plus a network connection attempt to an external/test host.
- Test 4Windows lab validation of downstream process spawn after payload render
Expected signal: Sysmon Event ID 1 (Process Creation) for powershell.exe with a benign command line, occurring shortly after a simulated attribute view API request.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-50551 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month