Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-50551.
Upgrade to ProDetect SiYuan Attribute View Asset Cell Stored XSS to RCE (CVE-2026-50551) in Sumo Logic CSE
Detects exploitation of CVE-2026-50551, a stored Cross-Site Scripting (CWE-79) vulnerability in SiYuan (github.com/siyuan-note/siyuan/kernel) affecting versions prior to 0.0.0-20260628153353-2d5d72223df4. Unsanitized attribute view asset cell content allows an attacker to inject malicious script/HTML that executes in the context of the SiYuan kernel's rendering surface, which can be chained with SiYuan's local kernel API and plugin/asset execution surfaces to achieve remote code execution. Detection focuses on suspicious payloads written into attribute view (database) asset cell fields, anomalous kernel HTTP API calls consistent with XSS-to-RCE chaining, and post-exploitation process/file activity on hosts running the SiYuan kernel service.
MITRE ATT&CK
Sumo Detection Query
_sourceCategory=web/access OR _sourceCategory=siyuan/kernel
| where uri_path matches "*api/av*" or uri_path matches "*api/attributeView*" or uri_path matches "*api/asset*"
| where request_body matches "*<script*" or request_body matches "*onerror=*" or request_body matches "*javascript:*" or request_body matches "*document.cookie*" or request_body matches "*eval(*"
| parse regex "(?<src_ip>\d+\.\d+\.\d+\.\d+)"
| count by src_ip, uri_path
| sort -_countSearches Sumo Logic ingested web/proxy and SiYuan kernel logs for XSS injection payloads targeting attribute view and asset API endpoints tied to CVE-2026-50551.
Data Sources
Required Tables
False Positives & Tuning
- Multiple legitimate users testing rich content input in the same time window
- Third-party integrations posting HTML-formatted content to the API for valid use cases
- Load balancer or CDN logging artifacts matching payload substrings
Other platforms for CVE-2026-50551
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Inject stored XSS payload into SiYuan attribute view asset cell
Expected signal: HTTP POST request to /api/av/setAttributeViewCell containing an <img onerror=...> payload in RequestBody, logged in proxy/access logs.
- Test 2Render malicious attribute view cell to trigger stored XSS
Expected signal: Kernel API request to render the attribute view; if a headless/WebView renderer is used, outbound network telemetry to attacker.example may be observed.
- Test 3Simulate XSS-to-RCE chain via local plugin/script execution
Expected signal: Process creation event for bash/curl spawned in close temporal proximity to the SiYuan kernel process, plus a network connection attempt to an external/test host.
- Test 4Windows lab validation of downstream process spawn after payload render
Expected signal: Sysmon Event ID 1 (Process Creation) for powershell.exe with a benign command line, occurring shortly after a simulated attribute view API request.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-50551 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month