CVE-2026-34449

CVE-2026-34449 affects SiYuan Desktop prior to 3.6.2. The root cause is a permissive CORS/Private Network policy in the local API (Access-Control-Allow-Origin: * and Access-Control-Allow-Private-Network: true) coupled with an endpoint that can inject JavaScript snippets. An attacker-controlled pa...