Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54158.
Upgrade to ProDetect SiYuan Attribute-View Stored XSS to RCE via genAVValueHTML() (CVE-2026-54158) in Microsoft Sentinel
SiYuan note-taking kernel is vulnerable to a stored Cross-Site Scripting (XSS) flaw in the genAVValueHTML() function used to render attribute-view (database) cell values. An attacker who can write attacker-controlled content into an attribute-view cell (via shared notebook, imported document, sync, or public API) can inject HTML/JavaScript that executes in the context of the SiYuan kernel's embedded webview/Electron renderer. Because the SiYuan kernel process has file-system access and can invoke internal APIs (plugin execution, kernel command endpoints, local file read/write), successful script execution can be escalated to full remote code execution on the host running the SiYuan desktop/server kernel. Affected versions are those prior to the fixed commit 2d5d72223df4 (2026-06-28). CVSS 9.9, CWE-79 (XSS) chained with CWE-1188 (Insecure Default Initialization of Resource) enabling the RCE escalation. A public PoC/advisory exists (GHSA-5xfx-xj4h-5p7r).
MITRE ATT&CK
KQL Detection Query
let SuspiciousPayloads = dynamic(["<script", "onerror=", "onload=", "javascript:", "<iframe", "eval(", "document.cookie"]);
let SiYuanProcesses = dynamic(["siyuan.exe", "SiYuan.exe", "siyuan-kernel.exe"]);
DeviceProcessEvents
| where FileName has_any (SiYuanProcesses)
| where ProcessCommandLine has_any (SuspiciousPayloads)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| union (
DeviceFileEvents
| where InitiatingProcessFileName has_any (SiYuanProcesses)
| where FileName endswith ".sy" or FileName endswith ".json"
| where FileName has_any (SuspiciousPayloads)
| project TimeGenerated, DeviceName, AccountName=InitiatingProcessAccountName, FileName, ProcessCommandLine="", InitiatingProcessFileName
)
| sort by TimeGenerated descDetects SiYuan kernel process activity or attribute-view (.sy/.json) document writes containing HTML/JS injection markers consistent with genAVValueHTML() stored XSS exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate notes containing code snippets with the literal string 'script' or 'eval(' for documentation purposes
- Developers testing HTML rendering features in a sandboxed SiYuan instance
- Security researchers validating the PoC in an isolated lab
Other platforms for CVE-2026-54158
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Inject stored XSS payload into SiYuan attribute-view cell
Expected signal: SiYuan kernel API access log entry for setAttributeViewBlockAttr; workspace .sy file modified with the injected payload string
- Test 2Render malicious attribute-view in SiYuan desktop client
Expected signal: Process creation event for SiYuan.exe with workspace argument; possible child process or renderer alert dialog captured via Sysmon
- Test 3Escalate stored XSS to local command execution via kernel plugin API
Expected signal: SiYuan kernel process spawning a child 'touch' process; file creation event for /tmp/siyuan_poc_marker
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54158 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month