Detect SiYuan Attribute-View Stored XSS to RCE via genAVValueHTML() (CVE-2026-54158) in Elastic Security
SiYuan note-taking kernel is vulnerable to a stored Cross-Site Scripting (XSS) flaw in the genAVValueHTML() function used to render attribute-view (database) cell values. An attacker who can write attacker-controlled content into an attribute-view cell (via shared notebook, imported document, sync, or public API) can inject HTML/JavaScript that executes in the context of the SiYuan kernel's embedded webview/Electron renderer. Because the SiYuan kernel process has file-system access and can invoke internal APIs (plugin execution, kernel command endpoints, local file read/write), successful script execution can be escalated to full remote code execution on the host running the SiYuan desktop/server kernel. Affected versions are those prior to the fixed commit 2d5d72223df4 (2026-06-28). CVSS 9.9, CWE-79 (XSS) chained with CWE-1188 (Insecure Default Initialization of Resource) enabling the RCE escalation. A public PoC/advisory exists (GHSA-5xfx-xj4h-5p7r).
MITRE ATT&CK
Elastic Detection Query
sequence by host.name with maxspan=5m
[process where process.name : ("siyuan.exe", "SiYuan.exe", "siyuan-kernel*") and
process.command_line : ("*<script*", "*onerror=*", "*onload=*", "*javascript:*", "*eval(*")]
[process where process.parent.name : ("siyuan.exe", "SiYuan.exe", "siyuan-kernel*") and
not process.name : ("siyuan.exe", "SiYuan.exe", "siyuan-kernel*", "conhost.exe")]Detects the SiYuan kernel rendering a payload containing script injection markers, immediately followed by an unexpected child process spawn indicating successful escalation from XSS to code execution.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate SiYuan plugin execution spawning helper processes
- Update/installer child processes spawned during normal SiYuan auto-update
Other platforms for CVE-2026-54158
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Inject stored XSS payload into SiYuan attribute-view cell
Expected signal: SiYuan kernel API access log entry for setAttributeViewBlockAttr; workspace .sy file modified with the injected payload string
- Test 2Render malicious attribute-view in SiYuan desktop client
Expected signal: Process creation event for SiYuan.exe with workspace argument; possible child process or renderer alert dialog captured via Sysmon
- Test 3Escalate stored XSS to local command execution via kernel plugin API
Expected signal: SiYuan kernel process spawning a child 'touch' process; file creation event for /tmp/siyuan_poc_marker
Response Playbook
Triage
- Identify the affected SiYuan kernel version on the host (check kernel binary version string or /appearance/boot/appconf.json) and confirm it predates the fixed commit 2d5d72223df4 (2026-06-28).
- Review the flagged attribute-view (.sy/.json) content for injected HTML/script tags, event handler attributes (onerror, onload), or javascript: URIs, and identify the source notebook/document and its origin (shared link, sync, import, or public API).
- Correlate the timestamp of the suspicious write with subsequent SiYuan kernel process activity to determine whether the payload rendered and spawned unexpected child processes or made unusual outbound/API calls.
- Check SiYuan kernel logs and OS-level process/file telemetry for any child processes, file reads/writes outside the workspace directory, or plugin invocations immediately following the injected content being opened/rendered.
Containment
- Isolate or disconnect the affected host from the network to prevent further data exfiltration or lateral movement if RCE is suspected, and immediately stop/disable the SiYuan kernel process.
- Revoke any shared notebook/workspace links or public API tokens that could have been used to inject the malicious attribute-view content, and rotate SiYuan API access tokens.
- Upgrade SiYuan to a version built after commit 2d5d72223df4 or apply the vendor patch before restarting the kernel service.
Evidence Collection
- Preserve the full contents of the affected workspace/data directory, including the raw .sy attribute-view files containing the injected payload, for forensic analysis.
- Collect SiYuan kernel application logs, OS process creation logs (Sysmon Event ID 1 / EDR equivalents), and network connection logs for the time window surrounding the suspicious render event.
- Capture a memory snapshot of the SiYuan kernel process if active exploitation and RCE are suspected, to recover any injected script or dropped payload artifacts.
Escalation Criteria
- !Escalate to incident response if any child process spawned by the SiYuan kernel executes shell commands, downloads external payloads, or accesses files/credentials outside the SiYuan workspace directory.
- !Escalate if the injected attribute-view content originated from an external/shared source (public link, federated sync, third-party plugin marketplace) indicating potential supply-chain or multi-user compromise.
- !Escalate if evidence of persistence (scheduled tasks, modified SiYuan plugins, startup script changes) is found on the host running the vulnerable kernel.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Attribute-view database files (.sy) or workspace JSON containing embedded <script>/onerror/javascript: payloads - >
SiYuan kernel process command-line arguments and child process tree at the time the malicious cell was rendered - >
SiYuan kernel HTTP API access logs showing the source (IP/user/token) that wrote the malicious attribute-view content
Tuning Guidance
Baseline legitimate SiYuan usage patterns (expected process names, typical workspace directories, and normal plugin child-process behavior) before enabling this rule in blocking/alerting mode, since technical documentation notes may legitimately contain strings like 'eval(' or 'script' in code blocks. Suppress alerts from known documentation/training workspaces and tune the regex to require actual HTML tag structure (e.g., '<script' followed by a closing '>' or an event-handler attribute assignment) rather than bare keyword matches to reduce false positives from prose mentioning these terms.
Hunting Queries
Proactively hunts across the environment for any .sy attribute-view files containing HTML/script injection markers, regardless of whether the SiYuan process has rendered them yet.
DeviceFileEvents
| where FileName endswith ".sy"
| where FileName has_any(dynamic(["<script","onerror=","javascript:"]))
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FolderPath, FileNameindex=endpoint sourcetype=osquery Filesystem.file_path="*.sy"
| regex Filesystem.file_name="(?i)(<script|onerror=|javascript:)"
| table _time, dest, user, Filesystem.file_pathAtomic Red Team Tests
Simulates an attacker writing a malicious HTML/JS payload into a SiYuan attribute-view (database) cell via the kernel's local API, mimicking the genAVValueHTML() exploitation path.
Command
curl -s -X POST http://127.0.0.1:6806/api/av/setAttributeViewBlockAttr -H 'Content-Type: application/json' -d '{"avID":"test-av-id","keyID":"test-key-id","rowID":"test-row-id","cellID":"test-cell-id","value":{"type":"text","text":{"content":"<img src=x onerror=alert(document.domain)>"}}}'Cleanup
curl -s -X POST http://127.0.0.1:6806/api/av/setAttributeViewBlockAttr -H 'Content-Type: application/json' -d '{"avID":"test-av-id","keyID":"test-key-id","rowID":"test-row-id","cellID":"test-cell-id","value":{"type":"text","text":{"content":"cleaned"}}}'Expected Telemetry
SiYuan kernel API access log entry for setAttributeViewBlockAttr; workspace .sy file modified with the injected payload string
Expected Detection
KQL/SPL rules alert on the .sy file write containing 'onerror=' pattern
Opens the previously injected attribute-view document in the SiYuan desktop client to trigger genAVValueHTML() rendering and observe script execution in the embedded webview.
Command
Start-Process -FilePath "C:\Program Files\SiYuan\SiYuan.exe" -ArgumentList "--workspace=C:\SiYuanTestWorkspace"Cleanup
Stop-Process -Name SiYuan -Force -ErrorAction SilentlyContinue; Remove-Item -Recurse -Force C:\SiYuanTestWorkspace\data\storage\av\test-av-id.json -ErrorAction SilentlyContinueExpected Telemetry
Process creation event for SiYuan.exe with workspace argument; possible child process or renderer alert dialog captured via Sysmon
Expected Detection
elastic_eql sequence rule fires on SiYuan process launch followed by unexpected child process spawn
Simulates the escalation step where injected JavaScript calls an internal SiYuan kernel endpoint (e.g., file export or system exec API) to achieve code execution on the host, demonstrating the CWE-1188 chain from XSS to RCE.
Command
curl -s -X POST http://127.0.0.1:6806/api/system/execCommand -H 'Content-Type: application/json' -d '{"cmd":"touch /tmp/siyuan_poc_marker"}'Cleanup
rm -f /tmp/siyuan_poc_markerExpected Telemetry
SiYuan kernel process spawning a child 'touch' process; file creation event for /tmp/siyuan_poc_marker
Expected Detection
qradar_aql and crowdstrike_cql rules alert on SiYuan-initiated child process execution correlating with the prior XSS injection event