CVE-2026-54067: SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

Synopsis

A stored cross-site scripting (XSS) to remote code execution (RCE) chain exists in SiYuan, an open-source personal knowledge management system, affecting versions before 3.7.0. The vulnerability is reachable over the network by any authenticated user with low privileges, requires no victim interaction, and stems from unsafe HTML interpolation in the renderSnippet() function that allows a CSS snippet to break out of its surrounding style tag and inject arbitrary JavaScript. On Electron desktop builds, the injected script reaches Node.js internals directly, giving an attacker full host-level code execution; because snippets sync across workspace devices, a single planted payload executes on every device that pulls the workspace. No fix version has been published upstream; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SiYuan service over the network to plant or trigger the malicious CSS snippet.

• AuthenticationRequired

  A low-privilege account with write access to any synced workspace is sufficient to plant the payload; no admin rights are needed.

• Victim interactionNot required

  No victim action is needed beyond the normal workspace sync pull that happens automatically on each connected device.

• Attack complexityDetail

  Exploitation is reliable and condition-free once workspace write access is obtained; no race conditions or special memory layout are required.

Blast Radius

• On Electron desktop builds, the injected script calls require('child_process') and executes arbitrary commands on the host operating system of every device that syncs the workspace.
• The payload reads any data accessible to the desktop process, including files, environment variables, and credentials stored on disk.
• The attacker can write or modify files on the host, install persistence mechanisms, or pivot to other services the user is authenticated to.
• The exploit bypasses the user's explicit enabledJS-off setting, running untrusted JavaScript through the CSS snippet path regardless of that control.