CVE-2026-33067

CRITICAL

SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-33067. PoCs published by Lopseg.

AI-analyzed exploit summary This repository contains a Nuclei template for detecting CVE-2026-33017, an unauthenticated RCE vulnerability in Langflow <= 1.8.2. The template performs non-destructive checks to differentiate between vulnerable and patched versions by analyzing HTTP response signatures.

Description

SiYuan is a personal knowledge management system. Versions 3.6.0 and below render package metadata fields (displayName, description) using template literals without HTML escaping. A malicious package author can inject arbitrary HTML/JavaScript into these fields, which executes automatically when any user browses the Bazaar page. Because SiYuan's Electron configuration enables nodeIntegration: true with contextIsolation: false, this XSS escalates directly to full Remote Code Execution on the victim's operating system — with zero user interaction beyond opening the marketplace tab. This issue has been fixed in version 3.6.1.

Exploits (1)

nomisec SCANNER

by Lopseg · poc

https://github.com/Lopseg/cve-2026-33067

View Code ZIP pw:eip

This repository contains a Nuclei template for detecting CVE-2026-33017, an unauthenticated RCE vulnerability in Langflow <= 1.8.2. The template performs non-destructive checks to differentiate between vulnerable and patched versions by analyzing HTTP response signatures.

Classification

Scanner 100%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Langflow <= 1.8.2

No auth needed

Prerequisites: Access to the target's /api/v1/version and /api/v1/build_public_tmp endpoints

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed May 13, 2026 Full analysis →

References (1)

Core 1

Core References

X_Refsource_Confirm x_refsource_confirm

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mvpm-v6q4-m2pf

Scores

CVSS v3 9.0

EPSS 0.0011

EPSS Percentile 29.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (3)

b3log/siyuan < 3.6.1

siyuan-note/siyuan 0 - 0.0.0-20260317012524-fe4523fff2c8Go

siyuan-note/siyuan < 3.6.1

Published Mar 20, 2026

Tracked Since Mar 20, 2026