Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54158.
Upgrade to ProDetect SiYuan Attribute-View Stored XSS to RCE via genAVValueHTML() (CVE-2026-54158) in Google Chronicle
SiYuan note-taking kernel is vulnerable to a stored Cross-Site Scripting (XSS) flaw in the genAVValueHTML() function used to render attribute-view (database) cell values. An attacker who can write attacker-controlled content into an attribute-view cell (via shared notebook, imported document, sync, or public API) can inject HTML/JavaScript that executes in the context of the SiYuan kernel's embedded webview/Electron renderer. Because the SiYuan kernel process has file-system access and can invoke internal APIs (plugin execution, kernel command endpoints, local file read/write), successful script execution can be escalated to full remote code execution on the host running the SiYuan desktop/server kernel. Affected versions are those prior to the fixed commit 2d5d72223df4 (2026-06-28). CVSS 9.9, CWE-79 (XSS) chained with CWE-1188 (Insecure Default Initialization of Resource) enabling the RCE escalation. A public PoC/advisory exists (GHSA-5xfx-xj4h-5p7r).
MITRE ATT&CK
YARA-L Detection Query
rule siyuan_genAVValueHTML_xss_rce
{
meta:
author = "df00tech"
description = "Detects CVE-2026-54158 SiYuan stored XSS to RCE via genAVValueHTML()"
severity = "CRITICAL"
events:
$proc.metadata.event_type = "PROCESS_LAUNCH"
$proc.target.process.file.full_path = /(?i)siyuan/
$proc.target.process.command_line = /(?i)(<script|onerror=|onload=|javascript:|eval\()/
condition:
$proc
}Detects Chronicle UDM process launch events for the SiYuan kernel with command-line arguments containing HTML/JS injection markers consistent with stored XSS exploitation of genAVValueHTML().
Data Sources
Required Tables
False Positives & Tuning
- Legitimate content containing matching substrings in documentation notes
- Internal red team validation of the PoC in a lab UDM feed
Other platforms for CVE-2026-54158
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Inject stored XSS payload into SiYuan attribute-view cell
Expected signal: SiYuan kernel API access log entry for setAttributeViewBlockAttr; workspace .sy file modified with the injected payload string
- Test 2Render malicious attribute-view in SiYuan desktop client
Expected signal: Process creation event for SiYuan.exe with workspace argument; possible child process or renderer alert dialog captured via Sysmon
- Test 3Escalate stored XSS to local command execution via kernel plugin API
Expected signal: SiYuan kernel process spawning a child 'touch' process; file creation event for /tmp/siyuan_poc_marker
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54158 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month