CVE-2026-34585

<!-- Malicious .sy block content example --> {: id="&quot; onmouseover=alert(1) //" }

{"cve": {"id": "CVE-2026-34585", "sourceIdentifier": "[email protected]", "published": "2026-03-31T22:16:22.080", "lastModified": "2026-04-03T16:52:22.293", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side attribute escaping when an HTML entity is mixed with raw special characters. An attacker can embed a malicious IAL value inside a .sy document, package it as a .sy.zip, and have the victim import it through the normal Import -> SiYuan .sy.zip workflow. Once the note is opened, the malicious attribute breaks out of its original HTML context and injects an event handler, resulting in stored XSS. In the Electron desktop client, this XSS reaches remote code execution because injected JavaScript runs with access to Node/Electron APIs. This issue has been patched in version 3.6.2."}, {"lang": "es", "value": "SiYuan es un sistema de gestión de conocimiento personal. Antes de la versión 3.6.2, una vulnerabilidad permite que valores de atributos de bloque manipulados eludan el escape de atributos del lado del servidor cuando una entidad HTML se mezcla con caracteres especiales sin procesar. Un atacante puede incrustar un valor IAL malicioso dentro de un documento .sy, empaquetarlo como un .sy.zip, y hacer que la víctima lo importe a través del flujo de trabajo normal de Importar -&gt; SiYuan .sy.zip. Una vez que se abre la nota, el atributo malicioso sale de su contexto HTML original e inyecta un gestor de eventos, resultando en XSS almacenado. En el cliente de escritorio Electron, este XSS alcanza la ejecución remota de código porque el JavaScript inyectado se ejecuta con acceso a las API de Node/Electron. Este problema ha sido parcheado en la versión 3.6.2."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 6.0}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.5, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.6.2", "matchCriteriaId": "27CB71A7-7208-417A-AE6D-266D57F683E9"}]}]}], "references": [{"url": "https://github.com/siyuan-note/siyuan/issues/17246", "source": "[email protected]", "tags": ["Issue Tracking"]}, {"url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ff66-236v-p4fg", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}, {"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ff66-236v-p4fg", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"]}]}}