{"id":"EUVD-2026-39128","enisaUuid":"e4c50aac-eee4-3053-8f15-6a137c8e0b81","description":"SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.","datePublished":"Jun 24, 2026, 9:20:42 PM","dateUpdated":"Jun 25, 2026, 1:20:40 PM","baseScore":9.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-56mp-4f3v-fgj2\n","aliases":"CVE-2026-50551\nGHSA-56mp-4f3v-fgj2\n","assigner":"GitHub_M","epss":0.56,"enisaIdProduct":[{"id":"2253eb60-7be8-3623-877b-d118babc9977","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"\u003c 3.7.0"}],"enisaIdVendor":[{"id":"d75d70fa-eb9a-36e0-ac92-cb591903415e","vendor":{"name":"siyuan-note"}}],"enisaIdVulnerability":[{"id":"8a84622c-8efb-303d-bb34-227ba0684507","vulnerability":{"id":"GHSA-56mp-4f3v-fgj2","description":"SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content","datePublished":"Jul 10, 2026, 8:37:04 PM","dateUpdated":"Jul 10, 2026, 8:37:04 PM","baseScore":0.0,"references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-56mp-4f3v-fgj2\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-50551\nhttps://github.com/siyuan-note/siyuan\n","enisa_id":"EUVD-2026-39128\n","aliases":"GHSA-56mp-4f3v-fgj2\nCVE-2026-50551\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9f4868c3-d746-398b-9fcf-80913a650e8d","vulnerability":{"id":"CVE-2026-50551","description":"SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.","datePublished":"Jun 24, 2026, 9:20:42 PM","dateUpdated":"Jun 25, 2026, 1:20:40 PM","status":"PUBLISHED","baseScore":9.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-56mp-4f3v-fgj2\n","enisa_id":"EUVD-2026-39128\n","assigner":"GitHub_M","epss":0.56,"dataProcessed":"Nov 7, 2026, 7:19:19 AM","vulnerabilityProduct":[{"id":"d29b7f51-84d5-3441-9075-c0ba08667eea","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"\u003c 3.7.0"}],"vulnerabilityVendor":[{"id":"9027d10a-acd2-3abf-98ac-01bf17dab886","vendor":{"name":"siyuan-note"}}]}}],"enisaIdAdvisory":[]}