CVE-2026-54069
CriticalPublic exploitPrior to 3.7.0, SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication.
Published Jun 24, 2026 · Updated Aug 12, 2026 · Also known as EUVD-2026-39125, GHSA-hvr9-72v2-fff3, GO-2026-5961
Key Facts
Patch immediately- CVE-2026-54069 is a critical-severity vulnerability (CVSS 9.2 v4) affecting github.com/siyuan-note/siyuan/kernel (go), SiYuan.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 0.6% probability of exploitation in the next 30 days.
- Fixed versions are available, including github.com/siyuan-note/siyuan/kernel 0.0.0-20260628153353-2d5d72223df4, SiYuan 3.7.0.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
CVSS v4
9.2
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS (30-day exploit likelihood)
0.6%
Higher than 46.5% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-54069 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication. Combined with the default empty AccessAuthCode on desktop installs, any Chrome/Chromium extension -- including a compromised legitimate extension via supply chain attack -- can make fully authenticated admin API calls to the SiYuan kernel at 127.0.0.1:6806, enabling data exfiltration, stored XSS injection, and configuration tampering. This vulnerability is fixed in 3.7.0.
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/siyuan-note/siyuan/kernelgo | See advisory | 0.0.0-20260628153353-2d5d72223df4 |
| SiYuan | See advisory | 3.7.0 |
Patched Releases
github.com/siyuan-note/siyuan/kernel
0.0.0-20260628153353-2d5d72223df4
SiYuan
3.7.0
Timeline
Publicly disclosed
Jun 24, 2026
Last updated
Aug 12, 2026
Weakness Type
- CWE-346 Origin Validation Error
References
FAQ
Common Questions.
SiYuan is an open-source personal knowledge management system.
Affected: github.com/siyuan-note/siyuan/kernel (go); SiYuan. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including github.com/siyuan-note/siyuan/kernel 0.0.0-20260628153353-2d5d72223df4, SiYuan 3.7.0.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-54069 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo