Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54067.
Upgrade to ProDetect SiYuan renderSnippet() CSS-Snippet Stored XSS to RCE (CVE-2026-54067) in Microsoft Sentinel
Detects exploitation of CVE-2026-54067, a stored XSS vulnerability in SiYuan's kernel renderSnippet() function where attacker-controlled CSS snippets can break out of <style> tag context to inject executable HTML/JS. Given SiYuan's Electron-based desktop kernel exposes privileged local APIs (file read/write, plugin execution, shell access), successful XSS can escalate to full remote code execution on the host running the SiYuan kernel/server. Detection focuses on malicious CSS snippet creation/import via the kernel HTTP API, anomalous style-tag breakout payloads, and downstream RCE indicators such as unexpected child processes spawned by the SiYuan kernel binary.
MITRE ATT&CK
KQL Detection Query
let SuspiciousSnippetPatterns = dynamic(["</style>","<script","onerror=","onload=","javascript:","expression(","</noscript>"]);
CommonSecurityLog
| where DeviceVendor =~ "SiYuan" or Activity has "snippet"
| where isnotempty(RequestURL)
| where RequestURL has_any ("/api/setting/setSnippet", "/api/system/setNetworkProxy", "snippet")
| extend Payload = tostring(parse_json(AdditionalExtensions).body)
| where Payload has_any (SuspiciousSnippetPatterns)
| project TimeGenerated, SourceIP, DeviceName, RequestURL, Payload, DestinationPort
| union (
DeviceProcessEvents
| where InitiatingProcessFileName has "siyuan" or InitiatingProcessCommandLine has "siyuan"
| where FileName in~ ("cmd.exe","powershell.exe","bash","sh","/bin/sh","osascript")
| project TimeGenerated, SourceIP=DeviceName, DeviceName, RequestURL=ProcessCommandLine, Payload=InitiatingProcessCommandLine, DestinationPort=int(null))
| sort by TimeGenerated descDetects (1) malicious CSS snippet payloads submitted to SiYuan's setSnippet API containing style-tag breakout sequences, and (2) suspicious child processes spawned by the SiYuan kernel process indicative of successful RCE post-XSS.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate advanced CSS customization by trusted admins using similar special characters
- Security scanners/pentesters submitting test payloads during authorized assessments
- Third-party plugins that legitimately inject inline scripts via approved extension APIs
Other platforms for CVE-2026-54067
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Submit CSS snippet with style breakout payload
Expected signal: HTTP POST logged to /api/setting/setSnippet containing '</style>' and '<script>' tokens in the request body
- Test 2Trigger snippet render and observe script execution
Expected signal: Browser/Electron process (siyuan.exe) network telemetry showing outbound request to the callback endpoint (e.g., 127.0.0.1:9999)
- Test 3Post-XSS local command execution via kernel API
Expected signal: Process creation event showing a shell/interpreter (sh, bash) spawned with parent process name matching siyuan kernel binary
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54067 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month