CVE-2024-2692
SiYuan 3.0.3 - RCE via Server Side XSS
SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
SiYuan 3.0.3 - RCE via Server Side XSS
SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS.
- Record
CVE-2024-2692- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-27638
SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS.
- Record
EUVD-2024-27638- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pgf5-9895-3ph9
SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because...
SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS.
- Record
GHSA-pgf5-9895-3ph9- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS.
- Record
CVE-2024-2692- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
SiYuan 3.0.3 - RCE via Server Side XSS
SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS.
- Record
CVE-2024-2692- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-2692 is a critical vulnerability (CVSS 9.0) in B3log Siyuan, published April 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. No source names a fixed version.