{"cve":"CVE-2026-44588","nvd":{"published":"2026-05-14T19:16:37.867","modified":"2026-06-17T10:50:52.560","status":"Deferred","description":"SiYuan is an open-source personal knowledge management system. Prior to 3.7.0,  he tooltip mouseover handler in app/src/block/popover.ts reads aria-label via getAttribute and passes it through decodeURIComponent before assigning to messageElement.innerHTML in app/src/dialog/tooltip.ts:41. The encoder used at the producer side, escapeAriaLabel in app/src/util/escape.ts:19-25, only handles HTML special characters (\", ', <, literal &lt;) — it leaves %XX URL-escapes untouched. So a doc title containing %3Cimg src=x onerror=...%3E round-trips through escapeAriaLabel and the HTML attribute layer unmodified. Then decodeURIComponent on the consumer side converts %3C to a literal < character (a real <, NOT a character reference). When that string is assigned to innerHTML, the HTML5 tokenizer enters TagOpenState on the literal <, parses the <img> element, and the onerror handler fires. Because the renderer runs with nodeIntegration: true, contextIsolation: false, webSecurity: false (app/electron/main.js:407-411), require('child_process') is reachable from the injected handler, escalating to arbitrary code execution.This vulnerability is fixed in 3.7.0.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":9.4},"cvss_v3":null,"cwes":["CWE-79","CWE-116","CWE-1188"],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-25rp-h46x-2hjm","https://github.com/siyuan-note/siyuan/security/advisories/GHSA-25rp-h46x-2hjm"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:35:16.954578616+00:00"},"epss":{"cve":"CVE-2026-44588","score":0.00509,"percentile":0.43468,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-25rp-h46x-2hjm","url":"https://osv.dev/vulnerability/GHSA-25rp-h46x-2hjm","summary":"SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)","modified":"2026-06-08T20:11:29Z","packages":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","purl":"pkg:golang/github.com/siyuan-note/siyuan/kernel","ranges":["<=0.0.0-20260421031503-96dfe0bea474"],"fixed":[]}]},{"id":"GO-2026-4993","url":"https://osv.dev/vulnerability/GO-2026-4993","summary":"SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585) in github.com/siyuan-note/siyuan/kernel","modified":"2026-05-20T19:30:12.987174803Z","packages":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","purl":"pkg:golang/github.com/siyuan-note/siyuan/kernel","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}