Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54067.
Upgrade to ProDetect SiYuan renderSnippet() CSS-Snippet Stored XSS to RCE (CVE-2026-54067) in Splunk
Detects exploitation of CVE-2026-54067, a stored XSS vulnerability in SiYuan's kernel renderSnippet() function where attacker-controlled CSS snippets can break out of <style> tag context to inject executable HTML/JS. Given SiYuan's Electron-based desktop kernel exposes privileged local APIs (file read/write, plugin execution, shell access), successful XSS can escalate to full remote code execution on the host running the SiYuan kernel/server. Detection focuses on malicious CSS snippet creation/import via the kernel HTTP API, anomalous style-tag breakout payloads, and downstream RCE indicators such as unexpected child processes spawned by the SiYuan kernel binary.
MITRE ATT&CK
SPL Detection Query
index=web sourcetype=siyuan_access (uri_path="*/api/setting/setSnippet*" OR uri_path="*snippet*")
| eval payload=coalesce(form_data, request_body, _raw)
| regex payload="(?i)(</style>|<script|onerror=|onload=|javascript:|expression\(|</noscript>)"
| table _time, src_ip, dest, uri_path, payload
| append [
search index=edr sourcetype=sysmon EventCode=1
| where match(ParentImage, "(?i)siyuan") OR match(ParentCommandLine, "(?i)siyuan")
| where match(Image, "(?i)(cmd\.exe|powershell|/bin/sh|/bin/bash|osascript)")
| table _time, src_ip=Computer, dest=Computer, uri_path=CommandLine, payload=ParentCommandLine
]
| sort -_timeIdentifies CSS-snippet HTTP submissions to SiYuan's snippet endpoint containing style-context breakout payloads, correlated with anomalous shell/process spawns by the SiYuan kernel indicating successful RCE.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Authorized CSS theming with special characters resembling breakout syntax
- Internal red team/pentest activity
- Automated CI tooling that pushes plugin/snippet configs containing similar strings
Other platforms for CVE-2026-54067
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Submit CSS snippet with style breakout payload
Expected signal: HTTP POST logged to /api/setting/setSnippet containing '</style>' and '<script>' tokens in the request body
- Test 2Trigger snippet render and observe script execution
Expected signal: Browser/Electron process (siyuan.exe) network telemetry showing outbound request to the callback endpoint (e.g., 127.0.0.1:9999)
- Test 3Post-XSS local command execution via kernel API
Expected signal: Process creation event showing a shell/interpreter (sh, bash) spawned with parent process name matching siyuan kernel binary
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54067 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month