Is CVE-2026-50551 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50551 being exploited in the wild.

How severe is CVE-2026-50551?

Critical severity, with a CVSS score of 9.9, published 24 June 2026.

Which products and versions are affected?

github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260628153353-2d5d72223df4, SEMVER:introduced=0,fixed=0.0.0-20260628153353-2d5d72223df4; SiYuan < 3.7.0.

Is there a fix for CVE-2026-50551?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260628153353-2d5d72223df4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50551 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-50551?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50551: SiYuan stored XSS to RCE in Attribute View asset cell renderer

Q: Is there a fix for CVE-2026-50551?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260628153353-2d5d72223df4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-50551 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-50551?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50551 · Severity: critical · CVSS 9.9 · Published 2026-06-24

SiYuan, a personal knowledge management and note-taking application, is vulnerable to a security flaw that allows attackers to execute malicious code on a user's computer. By sharing or syncing a specially crafted note containing a database table, an attacker can gain full control over the victim's system, including the ability to read all private notes, access local files, and steal credentials. This occurs automatically when the victim opens the malicious note or simply hovers their mouse over a specific part of it.

Technologies: github.com/siyuan-note/siyuan/kernel (Go), SiYuan. Vendors: Go, SiYuan.

Quick answers

Is CVE-2026-50551 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50551 being exploited in the wild.
How severe is CVE-2026-50551?: Critical severity, with a CVSS score of 9.9, published 24 June 2026.
Which products and versions are affected?: github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260628153353-2d5d72223df4, SEMVER:introduced=0,fixed=0.0.0-20260628153353-2d5d72223df4; SiYuan < 3.7.0.
Is there a fix for CVE-2026-50551?: Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260628153353-2d5d72223df4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50551 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-50551?: Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260628153353-2d5d72223df4 or later
```
go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260628153353-2d5d72223df4
```

Technical details

A stored XSS vulnerability exists in SiYuan's Attribute View (database) component due to insufficient sanitization of asset cell content. The application fails to escape user-provided input in 'app/src/protyle/render/av/cell.ts' and 'app/src/protyle/render/av/blockAttr.ts', leading to direct XSS on page load or hover-triggered XSS via the 'aria-label' attribute. Because the Electron desktop client is configured with 'nodeIntegration: true' and 'contextIsolation: false', an attacker can leverage this XSS to access Node.js APIs like 'child_process' and achieve full Remote Code Execution (RCE). The vulnerability is a result of an incomplete fix for a previous issue, where some renderers were updated but others were missed. A patch is available in version 0.0.0-20260628153353-2d5d72223df4.

Affected products

siyuan-note SiYuan <= 3.6.5

Identifiers

CVE-2026-50551
GHSA-56mp-4f3v-fgj2
GO-2026-5967

Timeline

2026-06-03: disclosed: Vulnerability reported to vendor
2026-06-24: advisory: NVD publication date
2026-06-28: patched: First patched version released
2026-07-10: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.