CVE-2026-41421 | SiYuan up to 3.6.4 Notification Message pushMsg msg os command injection (GHSA-grjj-6f6g-cq8q)

A vulnerability has been found in SiYuan up to 3.6.4 and classified as critical. This affects an unknown part of the file /api/notification/pushMsg of the component Notification Message Handler. The manipulation of the argument msg leads to os command injection.

This vulnerability is uniquely identified as CVE-2026-41421. Local access is required to approach this attack. No exploit exists.

The affected component should be upgraded.