{"id":"EUVD-2026-39128","revision":"3bfaecc5559d42e2816b050e7caeb7e3","records":[{"revision":"3bfaecc5559d42e2816b050e7caeb7e3","observedAt":"2026-10-28T07:14:16.088+00:00","statement":{"source":"euvd","id":"EUVD-2026-39128","aliases":["CVE-2026-50551","GHSA-56mp-4f3v-fgj2"],"title":"SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (R…","description":"SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9,"severity":null}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-56mp-4f3v-fgj2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39128","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 24, 2026, 9:20:42 PM","dateUpdated":"Jun 25, 2026, 1:20:40 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-39128","identifiers":["EUVD-2026-39128","CVE-2026-50551","GHSA-56mp-4f3v-fgj2"]},"retained":false,"historicalAffected":[]}],"coverage":[]}