SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (Access-Control-Allow-Origin: * + Access-Control-Allow-Private-Network: true) to inject a JavaScript snippet via the API. The injected snippet executes in Electron's Node.js context with full OS access the next time the user opens SiYuan's UI. No user interaction is required beyond visiting the malicious website while SiYuan is running. This issue has been patched in version 3.6.2.
References
| Link | Resource |
|---|---|
| https://github.com/siyuan-note/siyuan/issues/17246 | Issue Tracking |
| https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2 | Release Notes |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-68p4-j234-43mv | Exploit Vendor Advisory |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-68p4-j234-43mv | Exploit Vendor Advisory |
Configurations
History
03 Apr 2026, 16:57
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/siyuan-note/siyuan/issues/17246 - Issue Tracking | |
| References | () https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2 - Release Notes | |
| References | () https://github.com/siyuan-note/siyuan/security/advisories/GHSA-68p4-j234-43mv - Exploit, Vendor Advisory | |
| CPE | cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:* | |
| First Time |
B3log
B3log siyuan |
01 Apr 2026, 17:28
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/siyuan-note/siyuan/security/advisories/GHSA-68p4-j234-43mv - |
31 Mar 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-31 22:16
Updated : 2026-04-03 16:57
NVD link : CVE-2026-34449
Mitre link : CVE-2026-34449
CVE.ORG link : CVE-2026-34449
JSON object : View
Products Affected
b3log
- siyuan
CWE
CWE-942
Permissive Cross-domain Policy with Untrusted Domains