Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54067.
Upgrade to ProDetect SiYuan renderSnippet() CSS-Snippet Stored XSS to RCE (CVE-2026-54067) in Elastic Security
Detects exploitation of CVE-2026-54067, a stored XSS vulnerability in SiYuan's kernel renderSnippet() function where attacker-controlled CSS snippets can break out of <style> tag context to inject executable HTML/JS. Given SiYuan's Electron-based desktop kernel exposes privileged local APIs (file read/write, plugin execution, shell access), successful XSS can escalate to full remote code execution on the host running the SiYuan kernel/server. Detection focuses on malicious CSS snippet creation/import via the kernel HTTP API, anomalous style-tag breakout payloads, and downstream RCE indicators such as unexpected child processes spawned by the SiYuan kernel binary.
MITRE ATT&CK
Elastic Detection Query
sequence by host.name with maxspan=10m
[network where event.category == "network" and http.request.method == "POST" and url.path : "*snippet*" and http.request.body.content : ("*</style>*", "*<script*", "*onerror=*", "*javascript:*")]
[process where event.category == "process" and process.parent.name : "siyuan*" and process.name : ("cmd.exe","powershell.exe","sh","bash","osascript")]Sequence rule correlating a POST to a SiYuan snippet endpoint carrying a style breakout payload with a subsequent suspicious child process spawned from a siyuan-named parent process within 10 minutes.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate snippet management workflows using similar keywords
- Pentest/red-team validation traffic
- Unrelated scripts coincidentally named siyuan* spawning shells for maintenance
Other platforms for CVE-2026-54067
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Submit CSS snippet with style breakout payload
Expected signal: HTTP POST logged to /api/setting/setSnippet containing '</style>' and '<script>' tokens in the request body
- Test 2Trigger snippet render and observe script execution
Expected signal: Browser/Electron process (siyuan.exe) network telemetry showing outbound request to the callback endpoint (e.g., 127.0.0.1:9999)
- Test 3Post-XSS local command execution via kernel API
Expected signal: Process creation event showing a shell/interpreter (sh, bash) spawned with parent process name matching siyuan kernel binary
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54067 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month