Skip to content
Threat Feed
Subscribe

Product

SiYuan Kernel HTTP Server

1 brief RSS
critical advisory

SiYuan Unauthenticated Admin API Access via Chrome Extension Allowlist

A critical vulnerability (CVE-2026-54069) in SiYuan Note kernel's HTTP server allows any Chrome/Chromium browser extension to gain unauthenticated RoleAdministrator access, enabling data exfiltration, stored XSS injection, and configuration tampering for SiYuan desktop users, including via compromised legitimate extensions.

SiYuan Note +1 web-vulnerability privilege-escalation data-exfiltration xss supply-chain desktop-application chrome-extension siyuan
1r 6t 1c 1i