CVE-2026-54759: SiYuan: Lute HTML sanitizer allows `<iframe>` tags in Bazaar package README, leading to arbitrary command execution via SiYuan Electron client
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, Lute's HTML sanitizer does not remove <iframe> elements. Combined with the SiYuan Electron client's permissive security configuration, an attacker can include a malicious <iframe> in a Bazaar package README that executes arbitrary commands on the victim's machine when the package details are viewed. No package installation is required. This vulnerability is fixed in 3.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuan (Lute HTML sanitizer)to a version that resolves this vulnerability.Fixed in 3.7.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54759?
The severity of CVE-2026-54759 is rated high, with a CVSS score of 8.7.
How do I fix CVE-2026-54759?
To fix CVE-2026-54759, update to SiYuan version 3.7.0 or later where the vulnerability is addressed.
What are the risks associated with CVE-2026-54759?
The risks associated with CVE-2026-54759 include arbitrary command execution due to the inclusion of malicious <iframe> tags in the README.
Who is affected by CVE-2026-54759?
Users of SiYuan versions prior to 3.7.0, particularly those using the SiYuan Electron client, are affected by CVE-2026-54759.
What kind of vulnerability is CVE-2026-54759 classified as?
CVE-2026-54759 is classified as an XSS (cross-site scripting) vulnerability.