CVE-2026-32751 in SiYuan
Summary
by MITRE • 03/20/2026
SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the mobile file tree (MobileFiles.ts) renders notebook names via innerHTML without HTML escaping when processing renamenotebook WebSocket events. The desktop version (Files.ts) properly uses escapeHtml() for the same operation. An authenticated user who can rename notebooks can inject arbitrary HTML/JavaScript that executes on any mobile client viewing the file tree. Since Electron is configured with nodeIntegration: true and contextIsolation: false, the injected JavaScript has full Node.js access, escalating stored XSS to full remote code execution. The mobile layout is also used in the Electron desktop app when the window is narrow, making this exploitable on desktop as well. This issue has been fixed in version 3.6.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/25/2026
The vulnerability described in CVE-2026-32751 represents a critical security flaw in SiYuan, a personal knowledge management system that affects versions 3.6.0 and below. This issue manifests as a stored cross-site scripting vulnerability that specifically targets the mobile file tree rendering component, creating a pathway for authenticated attackers to execute arbitrary code across both mobile and desktop environments. The vulnerability stems from inconsistent security implementations between the mobile and desktop versions of the application, where the mobile component fails to properly sanitize user input while the desktop version implements appropriate HTML escaping mechanisms.
The technical flaw occurs within the MobileFiles.ts component where notebook names are rendered using innerHTML without proper HTML escaping when processing renamenotebook WebSocket events. This design inconsistency allows attackers to inject malicious HTML content that gets executed when other users view the file tree on mobile devices. The vulnerability is particularly dangerous because it leverages the Electron framework's security configuration where nodeIntegration is enabled and contextIsolation is disabled, creating an environment where injected JavaScript code can access full Node.js APIs. This configuration effectively transforms what would be a standard XSS vulnerability into a full remote code execution capability, as the malicious code can directly interact with the underlying operating system through Node.js capabilities.
The operational impact of this vulnerability extends beyond simple code execution to encompass complete system compromise across multiple platforms. Since the mobile layout is also utilized in the Electron desktop application when windows are narrow, the attack surface includes both mobile and desktop users of the application. This cross-platform exploitability means that an attacker who gains the ability to rename notebooks can potentially compromise any user viewing the file tree regardless of their platform. The vulnerability's exploitation requires only authenticated access to perform notebook renaming operations, making it particularly dangerous in environments where multiple users have access to the knowledge management system. The stored nature of the XSS vulnerability means that once exploited, the malicious code persists and executes automatically each time affected users view the compromised file tree, creating a persistent backdoor.
The remediation for this vulnerability required a fix implemented in version 3.6.1, which addressed the inconsistent security implementation between mobile and desktop components. The solution involved ensuring that the mobile file tree rendering properly escapes HTML content similar to the desktop implementation, thereby preventing malicious input from being executed as code. This fix aligns with established security principles and follows the CWE-79 (Cross-site Scripting) remediation strategies that emphasize proper input validation and output encoding. The vulnerability also relates to ATT&CK technique T1059.007 (Command and Scripting Interpreter: JavaScript) and T1133 (External Remote Services) as it enables attackers to execute arbitrary code through JavaScript injection and potentially leverage the compromised system for further attacks. Organizations using SiYuan should immediately update to version 3.6.1 or later to mitigate this risk, as the vulnerability represents a significant threat to system integrity and data security in environments where multiple users interact with the knowledge management system.