Attack Chain

1. A user installs a malicious or compromised Chrome/Chromium browser extension. The extension requires no special host_permissions as the SiYuan kernel is accessible via localhost.
2. The browser extension, executing its bg.js background script, initiates HTTP POST requests to the SiYuan kernel's API endpoint, typically http://127.0.0.1:6806.
3. The SiYuan kernel's CheckAuth middleware identifies the Origin header as chrome-extension:// and unconditionally bypasses authentication.
4. The SiYuan kernel assigns RoleAdministrator to the incoming request, effectively granting full administrative control to the extension.
5. The malicious extension makes API calls such as /api/system/getConf to verify its administrative access.
6. The extension then exploits its administrative access to perform actions like data exfiltration using /api/query/sql to extract the entire workspace or inject stored XSS payloads into notes via /api/block/insertBlock.
7. Further impact can include configuration tampering via /api/system/setConf, potentially leading to persistence or expanded attack surface.
8. The attacker achieves data exfiltration, persistent code execution via XSS, or other destructive actions within the SiYuan application.

Impact

The vulnerability (CVE-2026-54069) allows for full administrative control over the SiYuan Note kernel by any installed Chrome/Chromium extension. Successful exploitation enables unauthenticated data exfiltration of the entire workspace, including sensitive notes and documents, through APIs like /api/query/sql. Attackers can also inject stored XSS payloads into user notes, leading to persistent client-side code execution within the SiYuan application and potential session hijacking or further data compromise. Configuration tampering is possible via /api/system/setConf, which could be used to establish persistence or degrade the application's security. This vulnerability represents a significant supply chain risk, as a single compromised popular browser extension could silently affect a wide user base of SiYuan desktop users.

Recommendation

• Patch CVE-2026-54069 by upgrading SiYuan Note to a version beyond v3.6.5 that contains the fix for the blanket chrome-extension:// allowlist.
• Implement host-based intrusion detection system (HIDS) rules to alert on suspicious network connections originating from browser processes (e.g., chrome.exe, msedge.exe) to 127.0.0.1 on port 6806, as detailed in the Sigma rule below.
• Review web server or proxy logs (if applicable and configured to intercept loopback traffic) for HTTP POST requests to /api/query/sql, /api/block/insertBlock, or /api/system/setConf on 127.0.0.1:6806 with Origin headers starting with chrome-extension://.
• Monitor for unusual activity related to the SiYuan application, such as unexpected file modifications or API calls, which may indicate configuration tampering or data exfiltration.