Is CVE-2026-54067 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54067 being exploited in the wild.

How severe is CVE-2026-54067?

Critical severity, with a CVSS score of 9.9, published 24 June 2026.

Which products and versions are affected?

github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260628153353-2d5d72223df4, SEMVER:introduced=0,fixed=0.0.0-20260628153353-2d5d72223df4; SiYuan < 0.0.0-20260628153353-2d5d72223df4, < 3.7.0.

Is there a fix for CVE-2026-54067?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260628153353-2d5d72223df4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54067 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-54067?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54067: SiYuan stored XSS to RCE via CSS snippet breakout

Q: Is there a fix for CVE-2026-54067?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260628153353-2d5d72223df4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54067 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-54067?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54067 · Severity: critical · CVSS 9.9 · Published 2026-06-24

SiYuan, a personal knowledge management system, is vulnerable to a security flaw where malicious code can be hidden within custom CSS snippets. If an attacker gains write access to a synced workspace, they can inject code that automatically executes on all devices connected to that workspace. On desktop versions, this allows the attacker to take full control of the host computer, potentially leading to data theft or complete system compromise.

Technologies: github.com/siyuan-note/siyuan/kernel (Go), SiYuan. Vendors: Go, SiYuan.

Quick answers

Is CVE-2026-54067 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54067 being exploited in the wild.
How severe is CVE-2026-54067?: Critical severity, with a CVSS score of 9.9, published 24 June 2026.
Which products and versions are affected?: github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260628153353-2d5d72223df4, SEMVER:introduced=0,fixed=0.0.0-20260628153353-2d5d72223df4; SiYuan < 0.0.0-20260628153353-2d5d72223df4, < 3.7.0.
Is there a fix for CVE-2026-54067?: Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260628153353-2d5d72223df4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54067 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54067?: Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260628153353-2d5d72223df4 or later
```
go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260628153353-2d5d72223df4
```

Technical details

A stored XSS vulnerability exists in SiYuan's `renderSnippet()` function due to improper interpolation of CSS snippets using `insertAdjacentHTML`. An attacker can bypass the `<style>` tag context by including a `</style>` closing tag followed by a malicious HTML payload (e.g., an `<img>` tag with an `onerror` handler). In Electron-based desktop builds, the renderer runs with `nodeIntegration: true`, allowing the injected JavaScript to access Node.js APIs like `child_process` to achieve host Remote Code Execution (RCE). The vulnerability is particularly impactful because snippets are synchronized across workspaces, meaning a single malicious entry can propagate to and execute on all synced peer devices. A patch is available in version 0.0.0-20260628153353-2d5d72223df4.

Affected products

siyuan-note SiYuan < 0.0.0-20260628153353-2d5d72223df4

Identifiers

CVE-2026-54067
GHSA-mvjr-vv3c-w4qv
GO-2026-5963

Timeline

2026-04-21: other: Vulnerable version v3.6.5 identified
2026-06-24: advisory: NVD publication date
2026-07-10: patched: GitHub Advisory published and patched version confirmed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.