CVE-2026-33066 is a critical stored cross site scripting flaw in SiYuan, the personal knowledge management app. A malicious Bazaar package README can run script that escalates to remote code execution. NVD scores it 9.0. Update SiYuan to 3.6.1, the patched version.
What's affected
The NVD record says SiYuan 3.6.0 and below. The GitHub advisory lists SiYuan up to 3.5.9 and names v3.6.1 as the patched version. The ranges differ slightly, so treat anything below 3.6.1 as affected.
The advisory describes the Bazaar, SiYuan's community marketplace, as the entry point, and the desktop Electron app as the place where the impact becomes code execution.
How to check if you're exposed
Open the About dialog in SiYuan and read the version number. Anything older than 3.6.1 should be updated. If SiYuan is installed on shared or managed machines, use your software inventory to list the installed version on each one.
You can also see whether people have opened community packages recently, since the trigger is viewing a package's details page.
What to do now
- Update SiYuan to 3.6.1 or later on every device.
- Until you update, avoid opening package detail pages in the Bazaar, especially for packages you do not know.
- If someone viewed an unfamiliar package on an old version, treat that machine as suspect and review it for unexpected processes and changes.
- Rotate secrets stored on any machine you suspect was affected.
Why it matters
The weakness class is CWE-79. The advisory says the backend renders README Markdown without turning on HTML sanitizing, and the frontend then writes the result into the page as raw HTML.
Normally that is a web page problem. Here the Electron configuration enables Node integration and turns off context isolation, so script in the page can reach the operating system. That is why a README becomes remote code execution. The advisory notes this route needs one click, unlike the sibling metadata issue CVE-2026-33067. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
What is the fixed version?
The advisory and the NVD record both give SiYuan 3.6.1.
Why does a README matter for security?
Because the app displays README content from third parties as HTML. If that HTML is not sanitized and the app can reach the operating system, untrusted text becomes a way to run code.
Sources
Last reviewed: 19 October 2026.
