Description

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute stored JavaScript when other users open affected database menus, and in the Electron desktop app with nodeIntegration enabled, this leads to command execution with SiYuan process privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-09-26T14:16:46.427Z",
  "pubdate": "2026-09-26T14:16:46.427Z",
  "executiveSummary": "SiYuan versions prior to v3.8.4 are susceptible to a stored Cross-Site Scripting (XSS) vulnerability due to improper input sanitization of Attribute View values.\nThe vulnerability allows authenticated attackers to inject malicious JavaScript into several database-related fields, including field descriptions, template sources, select option descriptions, and footer calculation templates.\nWhen a victim views the compromised database menu, the stored payload executes within the context of their session.\nThe impact is severe; in the Electron desktop environment, where nodeIntegration is enabled, this XSS primitive escalates to arbitrary command execution with the privileges of the SiYuan process.\nSuccessful exploitation requires the attacker to have authentication to the SiYuan instance to modify the targeted Attribute View configuration.",
  "technicalDetails": "The vulnerability resides in the application's failure to properly escape user-supplied input rendered within textarea elements within Attribute Views. By injecting malicious JavaScript payloads into fields such as field descriptions, template sources, select option descriptions, or footer calculation templates, an attacker can persistently store arbitrary code on the server.\nThe attack flow begins with an authenticated attacker interacting with the Attribute View configuration interface. The attacker injects a script payload into one of the vulnerable textarea fields. Because the application fails to perform adequate output encoding or context-aware sanitization, the payload is stored verbatim in the underlying database.\nWhen a legitimate user navigates to an affected database menu, the SiYuan application renders the stored field content into the DOM without sufficient escaping. The browser interprets the injected string as active JavaScript rather than plain text, triggering execution in the victim's browser session.\nThe most critical impact occurs within the SiYuan Electron desktop client. Because the application operates with nodeIntegration enabled, the browser context has direct access to Node.js APIs. Consequently, an attacker can leverage the XSS payload to interact with the underlying operating system. The execution of arbitrary shell commands becomes possible, effectively granting the attacker full control over the host system with the same permissions as the SiYuan application process.\nThis vulnerability highlights a critical failure in the application's data handling logic for Attribute View configuration components. The lack of strict content security policies and the reliance on insecure rendering methods facilitate the transformation of a standard XSS attack into a platform-wide compromise. The vulnerability affects all versions of SiYuan leading up to v3.8.4."
}