SiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)
Published Apr 16, 2026
5.3
MEDIUMCVSS 4.0
EPSS 0.38%
Description
SiYuan is an open-source personal knowledge management system. In versions 3.6.1 through 3.6.3, a prior fix for XSS in bazaar README rendering (incomplete fix for CVE-2026-33066) enabled the Lute HTML sanitizer, but the sanitizer does not block iframe tags, and its URL-prefix blocklist does not effectively filter srcdoc attributes which contain raw HTML rather than URLs. A malicious bazaar package author can include an iframe with a srcdoc attribute containing embedded scripts in their README. When other users view the package in SiYuan's marketplace UI, the payload executes in the Electron context with full application privileges, enabling arbitrary code execution on the user's machine. This issue has been fixed in version 3.6.4.
Affected products
-
- Version < 3.6.4StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Siyuan-Note | Siyuan | n/a |
|
No data.
No Red Hat product state for this CVE.
github.com/siyuan-note/siyuan/kernel
Go
Introduced 0 Fixed 0.0.0-20260414013942-62eed37a3263
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/siyuan-note/siyuan/kernel | 0 | 0.0.0-20260414013942-62eed37a3263 |
Remediation
No remediation recorded yet.
References (8)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23331 Advisory
- https://github.com/advisories/GHSA-4663-4mpg-879v x_refsource_MISCThird Party Advisory
- https://github.com/advisories/GHSA-8q5w-mmxf-48jg Advisory
- https://github.com/siyuan-note/siyuan/commit/b382f50e1880ed996364509de5a10a72d7409428 x_refsource_MISCPatch
- https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4 x_refsource_MISCRelease Notes
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8q5w-mmxf-48jg exploitx_refsource_CONFIRMThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33066
- https://nvd.nist.gov/vuln/detail/CVE-2026-40922
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23331 | Advisory | |
| https://github.com/advisories/GHSA-4663-4mpg-879v | x_refsource_MISCThird Party Advisory | |
| https://github.com/advisories/GHSA-8q5w-mmxf-48jg | Advisory | |
| https://github.com/siyuan-note/siyuan/commit/b382f50e1880ed996364509de5a10a72d7409428 | x_refsource_MISCPatch | |
| https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4 | x_refsource_MISCRelease Notes | |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8q5w-mmxf-48jg | exploitx_refsource_CONFIRMThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-33066 | ||
| https://nvd.nist.gov/vuln/detail/CVE-2026-40922 |
Change history (0)
No recorded changes yet.