Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54067.
Upgrade to ProDetect SiYuan renderSnippet() CSS-Snippet Stored XSS to RCE (CVE-2026-54067) in Google Chronicle
Detects exploitation of CVE-2026-54067, a stored XSS vulnerability in SiYuan's kernel renderSnippet() function where attacker-controlled CSS snippets can break out of <style> tag context to inject executable HTML/JS. Given SiYuan's Electron-based desktop kernel exposes privileged local APIs (file read/write, plugin execution, shell access), successful XSS can escalate to full remote code execution on the host running the SiYuan kernel/server. Detection focuses on malicious CSS snippet creation/import via the kernel HTTP API, anomalous style-tag breakout payloads, and downstream RCE indicators such as unexpected child processes spawned by the SiYuan kernel binary.
MITRE ATT&CK
YARA-L Detection Query
rule siyuan_css_snippet_xss_to_rce {
meta:
author = "df00tech"
description = "Detects CVE-2026-54067 SiYuan CSS snippet style breakout XSS attempts"
severity = "CRITICAL"
events:
$http.metadata.event_type = "NETWORK_HTTP"
$http.target.url = /snippet/ nocase
$http.network.http.method = "POST"
re.regex($http.principal.process.command_line, `(?i)(</style>|<script|onerror=|javascript:)`)
condition:
$http
}UDM-based rule matching POST requests to SiYuan snippet endpoints whose associated payload/command line contains style-tag breakout or script injection markers.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate developer traffic pushing complex CSS snippets
- Authorized pentest simulation of the exploit
- Proxy logging systems that echo raw request bodies containing benign HTML samples
Other platforms for CVE-2026-54067
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Submit CSS snippet with style breakout payload
Expected signal: HTTP POST logged to /api/setting/setSnippet containing '</style>' and '<script>' tokens in the request body
- Test 2Trigger snippet render and observe script execution
Expected signal: Browser/Electron process (siyuan.exe) network telemetry showing outbound request to the callback endpoint (e.g., 127.0.0.1:9999)
- Test 3Post-XSS local command execution via kernel API
Expected signal: Process creation event showing a shell/interpreter (sh, bash) spawned with parent process name matching siyuan kernel binary
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54067 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month