SiYuan renderSnippet() CSS-Snippet Stored XSS to RCE (CVE-2026-54067)

let SuspiciousSnippetPatterns = dynamic(["</style>","<script","onerror=","onload=","javascript:","expression(","</noscript>"]);
CommonSecurityLog
| where DeviceVendor =~ "SiYuan" or Activity has "snippet"
| where isnotempty(RequestURL)
| where RequestURL has_any ("/api/setting/setSnippet", "/api/system/setNetworkProxy", "snippet")
| extend Payload = tostring(parse_json(AdditionalExtensions).body)
| where Payload has_any (SuspiciousSnippetPatterns)
| project TimeGenerated, SourceIP, DeviceName, RequestURL, Payload, DestinationPort
| union (
DeviceProcessEvents
| where InitiatingProcessFileName has "siyuan" or InitiatingProcessCommandLine has "siyuan"
| where FileName in~ ("cmd.exe","powershell.exe","bash","sh","/bin/sh","osascript")
| project TimeGenerated, SourceIP=DeviceName, DeviceName, RequestURL=ProcessCommandLine, Payload=InitiatingProcessCommandLine, DestinationPort=int(null))
| sort by TimeGenerated desc

index=web sourcetype=siyuan_access (uri_path="*/api/setting/setSnippet*" OR uri_path="*snippet*")
| eval payload=coalesce(form_data, request_body, _raw)
| regex payload="(?i)(</style>|<script|onerror=|onload=|javascript:|expression\(|</noscript>)"
| table _time, src_ip, dest, uri_path, payload
| append [
  search index=edr sourcetype=sysmon EventCode=1
  | where match(ParentImage, "(?i)siyuan") OR match(ParentCommandLine, "(?i)siyuan")
  | where match(Image, "(?i)(cmd\.exe|powershell|/bin/sh|/bin/bash|osascript)")
  | table _time, src_ip=Computer, dest=Computer, uri_path=CommandLine, payload=ParentCommandLine
]
| sort -_time

sequence by host.name with maxspan=10m
  [network where event.category == "network" and http.request.method == "POST" and url.path : "*snippet*" and http.request.body.content : ("*</style>*", "*<script*", "*onerror=*", "*javascript:*")]
  [process where event.category == "process" and process.parent.name : "siyuan*" and process.name : ("cmd.exe","powershell.exe","sh","bash","osascript")]

SELECT DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS EventTime, sourceip, destinationip, URL, payload
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Web%'
AND URL ILIKE '%snippet%'
AND (payload ILIKE '%</style>%' OR payload ILIKE '%<script%' OR payload ILIKE '%onerror=%' OR payload ILIKE '%javascript:%')
LAST 24 HOURS

_sourceCategory=siyuan/access
| json field=_raw "uri_path", "body" as uri_path, body nodrop
| where uri_path matches "*snippet*"
| where body matches "*</style>*" or body matches "*<script*" or body matches "*onerror=*" or body matches "*javascript:*"
| timeslice 5m
| count by _timeslice, uri_path, body
| sort -_count

rule siyuan_css_snippet_xss_to_rce {
  meta:
    author = "df00tech"
    description = "Detects CVE-2026-54067 SiYuan CSS snippet style breakout XSS attempts"
    severity = "CRITICAL"
  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.target.url = /snippet/ nocase
    $http.network.http.method = "POST"
    re.regex($http.principal.process.command_line, `(?i)(</style>|<script|onerror=|javascript:)`)
  condition:
    $http
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=DnsRequest
| ParentBaseFileName=/siyuan/i
| join(
    query={#event_simpleName=ProcessRollup2 | ParentBaseFileName=/siyuan/i | FileName=/(cmd\.exe|powershell\.exe|sh|bash|osascript)/i},
    field=aid, key=aid, mode=inner)
| table([_time, aid, ComputerName, ParentBaseFileName, FileName, CommandLine])