CVE-2026-39846

A malicious note synced to another user can trigger remote code execution in the SiYuan Electron desktop client. The root cause is that table caption content is stored without safe escaping and later unescaped into rendered HTML, creating a stored XSS sink. Because the desktop renderer runs with nodeIntegration enabled and contextIsolation disabled, attacker-controlled JavaScript executes with access to Node.js APIs. In practice, an attacker can import a crafted note into a synced workspace, wait for the victim to sync, and achieve code execution when the victim opens the note.

Details

The vulnerability exists in the table caption handling path. When a table block is parsed, the caption attribute is saved into the node's IAL properties without proper HTML escaping. Later, during rendering, that value is read back, passed through HTML unescaping, and written directly into the output DOM. This turns an attacker-controlled caption into active HTML inside the rendered note.

I confirmed that a crafted table caption containing encoded HTML such as <img src=x onerror=...> is rendered as a live DOM element instead of inert text. This makes the issue a stored XSS. I also confirmed that the most practical delivery path is not Markdown import, but a crafted .sy.zip note imported into a synced workspace. Once synced to another desktop client, opening the note executes the payload automatically.

In the Electron desktop client, this XSS results in code execution rather than browser-only script execution. The renderer is configured with nodeIntegration: true and contextIsolation: false, so JavaScript running in the note context can call Node.js APIs directly. A payload such as require('child_process').exec('calc') executes successfully, demonstrating code execution on the victim machine in the context of the logged-in user.

PoC

• SiYuan Desktop Client A: attacker
• SiYuan Desktop Client B: victim
• Both clients are configured to use the same sync target

PoC File

I created a malicious .sy.zip note containing a table block with a crafted caption property.

Safe validation payload:

<img src=x onerror=alert('caption-xss')>

RCE validation payload on Windows:

<img src=x onerror=require('child_process').exec('calc')>

Steps to Reproduce

1.On Client A, import the crafted .sy.zip note using:

Import -> SiYuan .sy.zip

2.Confirm the imported note appears in the workspace.

3.Trigger sync on Client A so the malicious note is uploaded to the shared sync target.

4.On Client B, trigger sync so the note is downloaded from the shared sync target.

5.Open the synced note on Client B.

Observed Result

With the safe payload, JavaScript executes automatically when the victim opens the note.
With the RCE payload, the Electron renderer executes:

require('child_process').exec('calc')

This launches Calculator on Windows, demonstrating code execution in the victim user's context.

• Impact Across All Platforms: Stored XSS
• Electron Desktop App: Remote Code Execution

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

CVE-2026-39846 has a CVSS score of 9.0 (Critical). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.0.0-20260407035653-2f416e5253f1); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-39846? CVE-2026-39846 is a critical-severity cross-site scripting (XSS) vulnerability in github.com/siyuan-note/siyuan/kernel (go), affecting versions < 0.0.0-20260407035653-2f416e5253f1. It is fixed in 0.0.0-20260407035653-2f416e5253f1. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. How severe is CVE-2026-39846? CVE-2026-39846 has a CVSS score of 9.0 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of github.com/siyuan-note/siyuan/kernel are affected by CVE-2026-39846? github.com/siyuan-note/siyuan/kernel (go) versions < 0.0.0-20260407035653-2f416e5253f1 is affected.
4. Is there a fix for CVE-2026-39846? Yes. CVE-2026-39846 is fixed in 0.0.0-20260407035653-2f416e5253f1. Upgrade to this version or later.
5. Is CVE-2026-39846 exploitable, and should I be worried? Whether CVE-2026-39846 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-39846 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-39846? Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260407035653-2f416e5253f1 or later.