Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-50551.
Upgrade to ProDetect SiYuan Attribute View Asset Cell Stored XSS to RCE (CVE-2026-50551) in Splunk
Detects exploitation of CVE-2026-50551, a stored Cross-Site Scripting (CWE-79) vulnerability in SiYuan (github.com/siyuan-note/siyuan/kernel) affecting versions prior to 0.0.0-20260628153353-2d5d72223df4. Unsanitized attribute view asset cell content allows an attacker to inject malicious script/HTML that executes in the context of the SiYuan kernel's rendering surface, which can be chained with SiYuan's local kernel API and plugin/asset execution surfaces to achieve remote code execution. Detection focuses on suspicious payloads written into attribute view (database) asset cell fields, anomalous kernel HTTP API calls consistent with XSS-to-RCE chaining, and post-exploitation process/file activity on hosts running the SiYuan kernel service.
MITRE ATT&CK
SPL Detection Query
index=web sourcetype=access_combined OR sourcetype=siyuan_kernel
(uri_path="*/api/av/*" OR uri_path="*/api/attributeView/*" OR uri_path="*/api/asset/*")
| regex _raw="(?i)(<script|onerror=|onload=|javascript:|document\.cookie|eval\(|child_process|os/exec)"
| eval flagged_payload=1
| join type=left max=0 host [
search index=endpoint sourcetype=sysmon EventCode=1
(CommandLine="*curl*" OR CommandLine="*wget*" OR CommandLine="*powershell*" OR CommandLine="*bash -c*" OR CommandLine="*/bin/sh -c*" OR CommandLine="*reverse*")
| rename ComputerName as host
| table _time host CommandLine
]
| table _time src_ip host uri_path _raw CommandLine
| sort - _timeDetects XSS payload injection attempts against SiYuan kernel attribute view/asset API endpoints and correlates with suspicious process execution indicative of RCE chaining for CVE-2026-50551.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Authorized vulnerability scanning or red team activity against SiYuan instances
- Legitimate rich-text/HTML content stored by users in attribute view cells
- False matches from benign strings containing 'javascript:' in documentation notes
Other platforms for CVE-2026-50551
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Inject stored XSS payload into SiYuan attribute view asset cell
Expected signal: HTTP POST request to /api/av/setAttributeViewCell containing an <img onerror=...> payload in RequestBody, logged in proxy/access logs.
- Test 2Render malicious attribute view cell to trigger stored XSS
Expected signal: Kernel API request to render the attribute view; if a headless/WebView renderer is used, outbound network telemetry to attacker.example may be observed.
- Test 3Simulate XSS-to-RCE chain via local plugin/script execution
Expected signal: Process creation event for bash/curl spawned in close temporal proximity to the SiYuan kernel process, plus a network connection attempt to an external/test host.
- Test 4Windows lab validation of downstream process spawn after payload render
Expected signal: Sysmon Event ID 1 (Process Creation) for powershell.exe with a benign command line, occurring shortly after a simulated attribute view API request.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-50551 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month