CVE-2026-34448
SiYuan, a personal knowledge management system, has a critical vulnerability that lets attackers inject malicious JavaScript via a crafted URL. The flaw is triggered when a user opens certain views, and in the Electron desktop client it can lead to arbitrary OS command execution. The issue is fixed in version 3.6.2.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
SiYuan personal knowledge management system, versions before 3.6.2, especially users of the Electron desktop client who enable “Cover From -> Asset Field” in Gallery or Kanban views.
Real-world impact
An attacker can run arbitrary commands on the victim’s computer, potentially taking full control of the system.
Why this severity
The CVSS score of 9 reflects the combination of network reachability, low attack complexity, and the ability to compromise confidentiality, integrity, and availability, with the added risk of executing OS commands due to the Electron environment.
What to do about it
- 01Upgrade SiYuan to version 3.6.2 or later.
NVD-referenced vendor advisory
Timeline
- Mar 31, 2026 · Mar 31, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/siyuan-note/siyuan/issues/1…issue tracking
- github.com/siyuan-note/siyuan/releases…release notes
- github.com/siyuan-note/siyuan/security…exploitvendor advisory