CVE-2026-33066 SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the backend renderREADME function uses lute.New without calling SetSanitizetrue, allowing raw HTML embedded in Markdown to pass through unmodified. The frontend then assigns the rendered HTML to innerHTML without any...

CVE-2026-33066 SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the backend renderREADME function uses lute.New without calling SetSanitizetrue, allowing raw HTML embedded in Markdown to pass through unmodified. The frontend then assigns the rendered HTML to innerHTML without any...

CVE-2026-33066

SiYuan CVE-2026-33066 affects versions 3.6.0 and earlier, where renderREADME can pass unsanitized HTML from Markdown to innerHTML, enabling stored XSS that escalates to RCE in Electron (nodeIntegration: true, contextIsolation: false). The incomplete fix in 3.6.1–3.6.3 allowed iframe-based XSS via...