CVE-2026-40922: 
NixOS vulnerability analysis and mitigation

CVE-2026-40922 is a stored Cross-Site Scripting (XSS) vulnerability in SiYuan, an open-source personal knowledge management system, that enables arbitrary code execution via a bypass of the Lute HTML sanitizer in bazaar (marketplace) README rendering. It affects SiYuan versions 3.6.1 through 3.6.3 and represents an incomplete fix for a prior vulnerability, CVE-2026-33066. The flaw was published on April 17, 2026, and patched in version 3.6.4. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The fix for CVE-2026-33066 added luteEngine.SetSanitize(true) to the renderPackageREADME() function in kernel/bazaar/readme.go, enabling the Lute HTML sanitizer. However, the Lute sanitizer in lute/render/sanitizer.go explicitly comments out iframe from its setOfElementsToSkipContent set, allowing <iframe> tags to pass through unblocked. Additionally, the sanitizer's URL-prefix blocklist (which blocks javascript: and data:text/html) is applied to the srcdoc attribute, but srcdoc contains raw HTML — not a URL — so values like <img src=x onerror=alert(1)> bypass the check entirely. A malicious bazaar package author can embed <iframe srcdoc="<script>alert(document.domain)</script>"> in their README.md, which passes sanitization and executes in the Electron renderer context (GitHub Advisory, Patch Commit).

Because SiYuan's Electron configuration uses nodeIntegration: true and contextIsolation: false, any JavaScript executing in the renderer process has direct access to Node.js APIs and full system privileges. A victim who views a malicious bazaar package in the marketplace UI triggers the payload, enabling the attacker to achieve arbitrary code execution on the victim's machine — including data theft (API tokens, SSH keys, SiYuan configuration, browser credentials), local file access, installation of persistent backdoors, and lateral movement. All desktop platforms (Windows, macOS, Linux) running affected SiYuan versions are impacted (GitHub Advisory).

A proof-of-concept Python script is publicly available via the GitHub Security Advisory, which simulates the Lute sanitizer's behavior and demonstrates that iframe srcdoc payloads bypass sanitization. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.064%, indicating a low near-term exploitation probability. Exploitation requires the attacker to have a low-privilege account (to publish a bazaar package) and requires user interaction (a victim must view the malicious package in the marketplace UI) (GitHub Advisory, Feedly).

1. Create a malicious bazaar package: Register as a bazaar package author and create a GitHub repository with a valid SiYuan plugin, theme, or template structure.
2. Craft the malicious README: In README.md, embed an iframe with a srcdoc attribute containing an XSS payload, e.g., <iframe srcdoc="<script>require('child_process').exec('calc.exe')</script>">. Alternatively, use an event-handler variant: <iframe srcdoc="<img src=x onerror=eval(atob('BASE64_PAYLOAD'))>">.
3. Submit to the SiYuan Bazaar: Submit the repository to the SiYuan community marketplace via the standard contribution process.
4. Wait for victim interaction: When a SiYuan user browses the marketplace and views the malicious package's README, the backend renders it via renderPackageREADME() with the incomplete sanitizer.
5. Payload execution: The <iframe srcdoc> passes through the Lute sanitizer unchecked. The browser renders the srcdoc HTML in a nested context, executing the embedded script in the Electron renderer with full Node.js privileges.
6. Achieve objectives: With Node.js access, execute arbitrary OS commands — establish a reverse shell, exfiltrate files, install persistence (e.g., cron job or scheduled task), or steal credentials (GitHub Advisory).

• Network: Unexpected outbound connections from the SiYuan Electron process to unknown external IPs or attacker-controlled domains shortly after a user browses the marketplace; DNS queries for attacker infrastructure.
• Process: Unusual child processes spawned by the SiYuan Electron process (e.g., cmd.exe, /bin/bash, curl, wget, python) that are not part of normal application behavior.
• File System: New or modified cron jobs, scheduled tasks, or startup entries created by the SiYuan process; unexpected scripts or executables written to the user's home directory or temp folders.
• Logs: SiYuan application logs showing requests to /api/bazaar/getBazaarPackageREADME for unfamiliar packages immediately before anomalous process activity; Electron renderer console errors related to iframe or script execution.

The fix is available in SiYuan version 3.6.4, released April 14, 2026. The patch adds iframe to the Lute sanitizer's setOfElementsToSkipContent set, preventing iframe tags from passing through. Users should upgrade to v3.6.4 or later immediately (SiYuan v3.6.4 Release, Patch Commit). As a temporary workaround for those unable to upgrade, avoid viewing packages from untrusted or unfamiliar bazaar package authors in the marketplace UI. Long-term hardening should include setting nodeIntegration: false, contextIsolation: true, and sandbox: true in Electron's webPreferences, and adding client-side sanitization (e.g., DOMPurify) as defense-in-depth (GitHub Advisory).

The vulnerability was noted on Bluesky via automated CVE tracking accounts shortly after disclosure. A brief write-up was published on infinitsec.net covering the incomplete sanitization bypass. No major vendor statements or prominent researcher commentary beyond the GitHub Security Advisory have been identified at this time (GitHub Advisory).