Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54158.
Upgrade to ProDetect SiYuan Attribute-View Stored XSS to RCE via genAVValueHTML() (CVE-2026-54158) in Sumo Logic CSE
SiYuan note-taking kernel is vulnerable to a stored Cross-Site Scripting (XSS) flaw in the genAVValueHTML() function used to render attribute-view (database) cell values. An attacker who can write attacker-controlled content into an attribute-view cell (via shared notebook, imported document, sync, or public API) can inject HTML/JavaScript that executes in the context of the SiYuan kernel's embedded webview/Electron renderer. Because the SiYuan kernel process has file-system access and can invoke internal APIs (plugin execution, kernel command endpoints, local file read/write), successful script execution can be escalated to full remote code execution on the host running the SiYuan desktop/server kernel. Affected versions are those prior to the fixed commit 2d5d72223df4 (2026-06-28). CVSS 9.9, CWE-79 (XSS) chained with CWE-1188 (Insecure Default Initialization of Resource) enabling the RCE escalation. A public PoC/advisory exists (GHSA-5xfx-xj4h-5p7r).
MITRE ATT&CK
Sumo Detection Query
_sourceCategory=endpoint_process_or_file
| where process_name matches "*siyuan*" or file_name matches "*.sy"
| where command_line matches "*<script*" or command_line matches "*onerror=*" or command_line matches "*javascript:*" or command_line matches "*eval(*"
| count by device_name, user_name, process_name, file_name
| sort by _countIdentifies SiYuan kernel process activity or attribute-view document writes with embedded script injection patterns matching the genAVValueHTML() stored XSS technique.
Data Sources
Required Tables
False Positives & Tuning
- Notes containing benign code samples with matching substrings
- Developer sandbox testing of the PoC
Other platforms for CVE-2026-54158
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Inject stored XSS payload into SiYuan attribute-view cell
Expected signal: SiYuan kernel API access log entry for setAttributeViewBlockAttr; workspace .sy file modified with the injected payload string
- Test 2Render malicious attribute-view in SiYuan desktop client
Expected signal: Process creation event for SiYuan.exe with workspace argument; possible child process or renderer alert dialog captured via Sysmon
- Test 3Escalate stored XSS to local command execution via kernel plugin API
Expected signal: SiYuan kernel process spawning a child 'touch' process; file creation event for /tmp/siyuan_poc_marker
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54158 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month