CVE-2026-34449

The record

SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (Access-Control-Allow-Origin: * + Access-Control-Allow-Private-Network: true) to inject a JavaScript snippet via the API. The injected snippet executes in Electron's Node.js context with full OS access the next time the user opens SiYuan's UI. No user interaction is required beyond visiting the malicious website while SiYuan is running. This issue has been patched in version 3.6.2.

Affected packages

Related vulnerabilities

• CVE-2026-53649 Joro is a web exploitation framework. CWE-942
• CVE-2025-61163 Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain… CWE-942
• CVE-2026-63407 Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your… CWE-942
• CVE-2026-18676 The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and… CWE-942
• CVE-2026-65310 ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected… CWE-942
• CVE-2026-21761 HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. CWE-942
• CVE-2026-59148 Mockoon provides way to design and run mock APIs. CWE-942
• CVE-2026-59726 Ruflo is an agent meta-harness for Claude Code and Codex. CWE-942