Is CVE-2026-44670 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44670 being exploited in the wild.

How severe is CVE-2026-44670?

Critical severity, with a CVSS score of 4, published 14 May 2026.

Which products and versions are affected?

github.com/siyuan-note/siyuan/kernel (Go) <= 0.0.0-20260421031503-96dfe0bea474, SEMVER:introduced=0,fixed=0.0.0-20260512140701-d7b77d945e0d; SiYuan < 3.7.0, <= 3.6.5.

Is there a fix for CVE-2026-44670?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260512140701-d7b77d945e0d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44670 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44670?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44670: SiYuan Stored XSS to RCE via Attribute View names

Q: Is there a fix for CVE-2026-44670?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260512140701-d7b77d945e0d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44670 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-44670?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44670 · Severity: critical · CVSS 4 · Published 2026-05-14

SiYuan, a personal knowledge management system, is vulnerable to a security flaw where malicious code can be embedded in database names. If a user views a document containing a specially crafted database name, an attacker can gain full control over the user's computer. This can lead to the theft of sensitive files, installation of malware, or complete loss of data privacy.

Technologies: github.com/siyuan-note/siyuan/kernel (Go), SiYuan. Vendors: Go, SiYuan.

Quick answers

Is CVE-2026-44670 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44670 being exploited in the wild.
How severe is CVE-2026-44670?: Critical severity, with a CVSS score of 4, published 14 May 2026.
Which products and versions are affected?: github.com/siyuan-note/siyuan/kernel (Go) <= 0.0.0-20260421031503-96dfe0bea474, SEMVER:introduced=0,fixed=0.0.0-20260512140701-d7b77d945e0d; SiYuan < 3.7.0, <= 3.6.5.
Is there a fix for CVE-2026-44670?: Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260512140701-d7b77d945e0d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44670 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44670?: Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260512140701-d7b77d945e0d or later
```
go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260512140701-d7b77d945e0d
```

Technical details

A stored XSS vulnerability exists in SiYuan's kernel where Attribute View (AV) names are stored and rendered without HTML escaping. The kernel uses raw string replacement to embed these names into HTML templates, which are then consumed by the Electron renderer via sinks like outerHTML and innerHTML. Because the Electron BrowserWindow is configured with nodeIntegration:true and contextIsolation:false, an attacker can escalate from HTML injection to arbitrary Node.js code execution. The vulnerability can be triggered remotely via malicious browser extensions (due to an allowlisted chrome-extension:// origin), shared workspace files, or sync replication. A patch is available in version 0.0.0-20260512140701-d7b77d945e0d.

Affected products

siyuan-note SiYuan <= 3.6.5

Identifiers

CVE-2026-44670
GHSA-2h64-c999-c9r6
GO-2026-4992

Timeline

2026-05-04: advisory: GitHub Advisory published
2026-05-08: disclosed: CVE-2026-44670 assigned
2026-05-12: patched: Fixed in kernel version 0.0.0-20260512140701-d7b77d945e0d

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.