CVE-2026-39846: 
NixOS vulnerability analysis and mitigation

CVE-2026-39846 is a stored XSS vulnerability in SiYuan (a personal knowledge management system) that escalates to remote code execution (RCE) in the Electron desktop client via malicious synced table captions. Affecting all versions prior to 3.6.4 (b3log/siyuan), it was published on April 7, 2026, and patched in version 3.6.4 released the same day. The vulnerability carries a CVSS v3.1 base score of 9.0 (Critical) (GitHub Advisory, SiYuan Advisory).

The root cause (CWE-79, CWE-94) lies in SiYuan's table caption handling path: when a table block is parsed, the caption attribute is saved into the node's IAL properties without HTML escaping, then later read back, passed through HTML unescaping, and written directly into the rendered DOM — creating a stored XSS sink. Because the Electron desktop renderer is configured with nodeIntegration: true and contextIsolation: false, any JavaScript injected via the caption executes with full access to Node.js APIs, elevating stored XSS to RCE. The most practical delivery vector is a crafted .sy.zip note file imported into a shared sync workspace; once the victim syncs and opens the note, the payload fires automatically. A confirmed PoC payload is <img src=x onerror=require('child_process').exec('calc')> embedded in the table caption (SiYuan Advisory, GitHub Advisory).

Successful exploitation grants the attacker arbitrary code execution on the victim's machine in the context of the logged-in user, with full access to Node.js APIs and the underlying operating system. This results in complete compromise of confidentiality, integrity, and availability — an attacker can exfiltrate sensitive data stored in the knowledge base or on the filesystem, install persistent malware, or pivot to other systems accessible from the victim's machine. All platforms running the SiYuan Electron desktop client (Windows, macOS, Linux) are affected by RCE; web-only users experience stored XSS without the Node.js escalation (SiYuan Advisory).

A proof-of-concept exploit with concrete reproduction steps and payloads is publicly available in the GitHub Security Advisory, confirmed as a real exploit by Feedly threat intelligence (SiYuan Advisory). Exploitation requires the attacker to have low-privilege access to a shared sync workspace (authenticated), and the victim must open the malicious note — making user interaction a prerequisite. As of the time of reporting, there is no evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.063% (0.00138 per Feedly), and the vulnerability is not listed in the CISA KEV catalog. Qualys scanner (detection ID 5010566) has added detection for this CVE (GitHub Advisory).

1. Craft malicious note: Create a SiYuan .sy.zip note file containing a table block whose caption IAL property holds an HTML-injected payload, e.g., <img src=x onerror=require('child_process').exec('calc')> (for Windows RCE) or <img src=x onerror=alert('caption-xss')> (for XSS validation).
2. Import on attacker client: On the attacker's SiYuan Desktop Client (Client A), import the crafted note via Import → SiYuan .sy.zip and confirm it appears in the workspace.
3. Sync to shared target: Trigger sync on Client A to upload the malicious note to the shared sync target (e.g., S3, WebDAV, or SiYuan Cloud).
4. Victim syncs: Wait for the victim (Client B), who shares the same sync target, to perform a sync — the malicious note is downloaded automatically.
5. Trigger RCE: The victim opens the synced note in the SiYuan Electron desktop client. The renderer processes the table caption, unescapes the HTML, and injects it into the DOM. Because nodeIntegration: true and contextIsolation: false are set, the onerror handler executes require('child_process').exec('calc'), launching arbitrary code in the victim's user context (SiYuan Advisory, GitHub Advisory).

• File System: Presence of a .sy.zip note file with a table block containing HTML tags (e.g., <img, onerror=, require() in the caption IAL property; unexpected files written to disk by the SiYuan process after opening a synced note.
• Process: Unusual child processes spawned by the SiYuan Electron renderer process (e.g., calc.exe, cmd.exe, powershell.exe on Windows; bash, sh, python on Linux/macOS); node or Electron subprocess executing system commands.
• Network: Outbound connections from the SiYuan process to unexpected external hosts (e.g., attacker-controlled C2) following note sync and open events; unusual data exfiltration traffic originating from the SiYuan process.
• Logs: SiYuan application logs showing import of a .sy.zip file followed immediately by sync and note-open events; OS-level audit logs recording process creation by the SiYuan Electron renderer with suspicious command-line arguments (SiYuan Advisory).

Upgrade SiYuan to version 3.6.4 or later, which fixes the table caption escaping issue (SiYuan Advisory, GitHub Advisory). Until patching is possible, restrict note syncing to fully trusted users only and avoid opening notes imported from untrusted or unknown sources in shared workspaces. Review and tighten access controls on shared sync targets to limit who can import and modify notes.

The vulnerability was reported by researcher ngocnn97 and disclosed via GitHub Security Advisories on April 7–8, 2026 (SiYuan Advisory). Coverage appeared on The Hacker Wire and security aggregators shortly after disclosure. A Mastodon post from the offseq account highlighted the issue on infosec.exchange. No major vendor statements beyond the official advisory or significant community controversy have been identified.