CVE-2026-54158: Stored XSS in SiYuan's genAVValueHTML() Chains to Full Kernel RCE
What's Happening
SiYuan, an open-source note-taking application, ships a kernel function called genAVValueHTML() that renders cell values inside attribute-view (database-style) blocks. The function fails to properly sanitize attacker-controlled content before rendering it, resulting in a stored Cross-Site Scripting vulnerability (CWE-79).
What makes this critical rather than a routine XSS bug is the execution context: SiYuan's UI runs inside an embedded webview/Electron renderer that is tightly coupled to the kernel process. That kernel process holds file-system access and can invoke internal APIs — including plugin execution and local kernel command endpoints. Combined with insecure default initialization of these resources (CWE-1188), injected script can escalate from a browser-context XSS payload to arbitrary remote code execution on the host running the SiYuan desktop or server kernel.
Attack Path
An attacker doesn't need direct access to the target's SiYuan instance. Attacker-controlled content can reach a vulnerable attribute-view cell through several vectors:
- A shared notebook the victim opens
- An imported document containing a crafted cell value
- Sync from a compromised or malicious source
- A public API call that writes cell content
Once the malicious value is rendered via genAVValueHTML(), the payload executes in the kernel's rendering context and can pivot to RCE.
Affected Software
This affects github.com/siyuan-note/siyuan/kernel, all versions prior to the fixed commit 2d5d72223df4 (2026-06-28). Any deployment — desktop or self-hosted server kernel — running an unpatched build is exposed.
Exploitation Status
A public proof-of-concept and advisory are available (GHSA-5xfx-xj4h-5p7r), and this vulnerability is not yet marked as CISA KEV. With a CVSS score of 9.9 and a public writeup lowering the barrier to weaponization, defenders should treat this as high-priority even without confirmed in-the-wild exploitation — PoC-public vulnerabilities in self-hosted note/collaboration tools are a common target for opportunistic scanning shortly after disclosure.
How Our Detection Catches It
We ship coverage for this technique across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL). At a high level, the detection logic focuses on identifying anomalous rendering-triggered process or file-system activity originating from the SiYuan kernel process — such as unexpected child process spawns, plugin-directory writes, or local file read/write operations correlated with attribute-view content ingestion (imports, sync events, or API writes) that would not occur during normal note-taking usage. This lets defenders flag the post-exploitation pivot from script execution to host-level activity, rather than relying solely on payload signature matching in cell content.
For the full detection logic, MITRE ATT&CK mapping, and ready-to-deploy queries across all supported SIEMs, see the CVE-2026-54158 detection page.