SiYuan Attribute-View Stored XSS to RCE via genAVValueHTML() (CVE-2026-54158)

let SuspiciousPayloads = dynamic(["<script", "onerror=", "onload=", "javascript:", "<iframe", "eval(", "document.cookie"]);
let SiYuanProcesses = dynamic(["siyuan.exe", "SiYuan.exe", "siyuan-kernel.exe"]);
DeviceProcessEvents
| where FileName has_any (SiYuanProcesses)
| where ProcessCommandLine has_any (SuspiciousPayloads)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| union (
DeviceFileEvents
| where InitiatingProcessFileName has_any (SiYuanProcesses)
| where FileName endswith ".sy" or FileName endswith ".json"
| where FileName has_any (SuspiciousPayloads)
| project TimeGenerated, DeviceName, AccountName=InitiatingProcessAccountName, FileName, ProcessCommandLine="", InitiatingProcessFileName
)
| sort by TimeGenerated desc

index=endpoint (Processes.process_name IN ("siyuan.exe", "SiYuan.exe", "siyuan-kernel.exe") OR Filesystem.file_path="*.sy")
| regex Processes.process OR Filesystem.file_name="(?i)(<script|onerror=|onload=|javascript:|<iframe|eval\(|document\.cookie)"
| stats count min(_time) as firstTime max(_time) as lastTime by dest, user, Processes.process, Filesystem.file_name
| where count > 0
| convert ctime(firstTime) ctime(lastTime)

sequence by host.name with maxspan=5m
  [process where process.name : ("siyuan.exe", "SiYuan.exe", "siyuan-kernel*") and
   process.command_line : ("*<script*", "*onerror=*", "*onload=*", "*javascript:*", "*eval(*")]
  [process where process.parent.name : ("siyuan.exe", "SiYuan.exe", "siyuan-kernel*") and
   not process.name : ("siyuan.exe", "SiYuan.exe", "siyuan-kernel*", "conhost.exe")]

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') as EventTime, sourceip, username, "Process Name", "Process Command Line", "File Name"
FROM events
WHERE ("Process Name" ILIKE '%siyuan%' OR "File Name" ILIKE '%.sy')
AND ("Process Command Line" ILIKE '%<script%' OR "Process Command Line" ILIKE '%onerror=%' OR "Process Command Line" ILIKE '%javascript:%' OR "Process Command Line" ILIKE '%eval(%')
LAST 24 HOURS

_sourceCategory=endpoint_process_or_file
| where process_name matches "*siyuan*" or file_name matches "*.sy"
| where command_line matches "*<script*" or command_line matches "*onerror=*" or command_line matches "*javascript:*" or command_line matches "*eval(*"
| count by device_name, user_name, process_name, file_name
| sort by _count

rule siyuan_genAVValueHTML_xss_rce
{
  meta:
    author = "df00tech"
    description = "Detects CVE-2026-54158 SiYuan stored XSS to RCE via genAVValueHTML()"
    severity = "CRITICAL"
  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.target.process.file.full_path = /(?i)siyuan/
    $proc.target.process.command_line = /(?i)(<script|onerror=|onload=|javascript:|eval\()/
  condition:
    $proc
}

#event_simpleName=ProcessRollup2 OR #event_simpleName=FileWritten
| FileName=/(?i)siyuan/ OR TargetFileName=/\.sy$/
| CommandLine=/(?i)(<script|onerror=|onload=|javascript:|eval\()/ OR TargetFileName=/(?i)(<script|onerror=|onload=|javascript:|eval\()/
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, TargetFileName])