# CVE-2026-50551: SiYuan stored XSS to RCE in Attribute View asset cell renderer

Source: https://junglewise.ai/threats/cve-2026-50551-siyuan-stored-xss-to-rce-in-attribute-view-asset-cell-renderer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-50551 · Severity: critical · CVSS 9.9 · Published 2026-06-24

SiYuan, a personal knowledge management and note-taking application, is vulnerable to a security flaw that allows attackers to execute malicious code on a user's computer. By sharing or syncing a specially crafted note containing a database table, an attacker can gain full control over the victim's system, including the ability to read all private notes, access local files, and steal credentials. This occurs automatically when the victim opens the malicious note or simply hovers their mouse over a specific part of it.

Technologies: [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel), [SiYuan](https://junglewise.ai/threats/technologies/siyuan). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [SiYuan](https://junglewise.ai/threats/vendors/siyuan).

## Quick answers

**Is CVE-2026-50551 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50551 being exploited in the wild.

**How severe is CVE-2026-50551?** Critical severity, with a CVSS score of 9.9, published 24 June 2026.

**Which products and versions are affected?** github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260628153353-2d5d72223df4, SEMVER:introduced=0,fixed=0.0.0-20260628153353-2d5d72223df4; SiYuan < 3.7.0.

**Is there a fix for CVE-2026-50551?** Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260628153353-2d5d72223df4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50551 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-50551?** Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260628153353-2d5d72223df4 or later

  ```sh
  go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260628153353-2d5d72223df4
  ```


## Technical details

A stored XSS vulnerability exists in SiYuan's Attribute View (database) component due to insufficient sanitization of asset cell content. The application fails to escape user-provided input in 'app/src/protyle/render/av/cell.ts' and 'app/src/protyle/render/av/blockAttr.ts', leading to direct XSS on page load or hover-triggered XSS via the 'aria-label' attribute. Because the Electron desktop client is configured with 'nodeIntegration: true' and 'contextIsolation: false', an attacker can leverage this XSS to access Node.js APIs like 'child_process' and achieve full Remote Code Execution (RCE). The vulnerability is a result of an incomplete fix for a previous issue, where some renderers were updated but others were missed. A patch is available in version 0.0.0-20260628153353-2d5d72223df4.

## Affected products

- siyuan-note SiYuan <= 3.6.5

## Identifiers

- CVE-2026-50551
- GHSA-56mp-4f3v-fgj2
- GO-2026-5967

## Timeline

- 2026-06-03: disclosed: Vulnerability reported to vendor
- 2026-06-24: advisory: NVD publication date
- 2026-06-28: patched: First patched version released
- 2026-07-10: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/Yunkaiwjs](https://api.github.com/users/Yunkaiwjs)
- [https://github.com/Yunkaiwjs](https://github.com/Yunkaiwjs)
- [https://api.github.com/users/Yunkaiwjs/gists%7B/gist_id%7D](https://api.github.com/users/Yunkaiwjs/gists%7B/gist_id%7D)
- [https://api.github.com/users/Yunkaiwjs/repos](https://api.github.com/users/Yunkaiwjs/repos)
- [https://avatars.githubusercontent.com/u/235860593?v=4](https://avatars.githubusercontent.com/u/235860593?v=4)
- [https://api.github.com/users/Yunkaiwjs/events%7B/privacy%7D](https://api.github.com/users/Yunkaiwjs/events%7B/privacy%7D)

## Related threats

- [SiYuan path traversal in web fetch](https://junglewise.ai/threats/cve-2026-126776-siyuan-3-7-0-before-3-8-10-on-windows-contains-a-path-traversal)
- [SiYuan publish filter information disclosure in local storage](https://junglewise.ai/threats/go-2026-6836-siyuan-the-publish-filter-for-local-storage-returns-the-7f022e62)
- [SiYuan path traversal via GLOBALROOT alias bypass](https://junglewise.ai/threats/cve-2026-118680-siyuan-3-8-7-through-3-8-8-fails-to-normalize-windows-globalroot)
- [SiYuan SQL injection in history search](https://junglewise.ai/threats/cve-2026-116170-siyuan-before-v3-8-7-contains-an-sql-injection-vulnerability)
- [SiYuan cross-site scripting in /check-auth redirect](https://junglewise.ai/threats/cve-2026-116167-siyuan-from-2-9-0-before-3-8-7-contains-a-cross-site-scripting)