CVE-2026-34449
SiYuan, a personal knowledge‑management app, had a critical flaw that let attackers run arbitrary code on a user’s computer by visiting a malicious website while SiYuan was open. The flaw was fixed in version 3.6.2.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
SiYuan personal knowledge‑management system, desktop versions prior to 3.6.2.
Real-world impact
An attacker could execute any code with full operating‑system privileges on the victim’s machine, steal data, install malware, or take complete control, without the user needing to do anything beyond visiting a malicious site.
Why this severity
The CVSS score of 9.6 reflects that the vulnerability is network‑exploitable, requires no user interaction, and grants an attacker full system control, leading to total compromise.
What to do about it
- 011. Download and install SiYuan version 3.6.2 or later.
- 022. Restart the SiYuan application.
NVD-referenced vendor advisory
Timeline
- Mar 31, 2026 · Mar 31, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/siyuan-note/siyuan/issues/1…issue tracking
- github.com/siyuan-note/siyuan/releases…release notes
- github.com/siyuan-note/siyuan/security…exploitvendor advisory