Description

SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, attackers can inject JavaScript that calls Node.js child_process APIs to execute arbitrary commands with user privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-09-26T14:16:46.743Z",
  "pubdate": "2026-09-26T14:16:46.743Z",
  "executiveSummary": "A critical stored cross-site scripting (XSS) vulnerability exists in SiYuan versions 3.7.0 through 3.8.3. The flaw originates from improper input sanitization within the gallery and kanban database renderers. Specifically, field descriptions are rendered into aria-label attributes without escaping, allowing for the injection of arbitrary malicious scripts. Because the SiYuan Electron desktop application environment utilizes nodeIntegration, this XSS vulnerability can be escalated to remote code execution (RCE). An attacker capable of injecting malicious content into a shared or accessible database can achieve full system command execution under the privileges of the local user. This vulnerability poses a severe security risk, as it permits unauthorized system-level operations, potential data exfiltration, or persistence mechanisms on the host machine. Exploitation requires the attacker to influence the contents of a field description that is subsequently processed by the vulnerable renderer. Given the nature of collaborative or sync-capable note-taking applications, this represents a significant threat to confidentiality, integrity, and availability of the local host environment.",
  "technicalDetails": "The root cause of this vulnerability is a failure to implement proper output encoding for user-supplied data in the gallery and kanban database components of SiYuan. Specifically, the application reflects field descriptions directly into the aria-label attribute of DOM elements without sanitization. In a standard web context, this would typically be constrained by Content Security Policy (CSP) or browser-based XSS protections; however, SiYuan operates within an Electron framework instance configured with nodeIntegration enabled.\nThe attack flow begins when an attacker inserts a crafted payload into a database field description. When a victim views the affected gallery or kanban board, the application's renderer injects this payload into the DOM via the aria-label attribute. Because the application context includes access to Node.js primitives, the injected script is not limited to the sandbox of a standard browser tab. Instead, the payload can invoke the 'child_process' module, specifically functions such as 'exec' or 'spawn'.\nA typical exploitation payload would involve injecting a string designed to break out of the HTML attribute context—such as '\" onmouseover=\"require(\\'child_process\\').exec(\\'calc.exe\\')\"'—or similar JavaScript execution patterns enabled by the Electron environment. Once the JavaScript engine evaluates this code, it executes with the full privileges of the SiYuan application process. This grants the attacker the ability to interact with the underlying operating system file system, network stack, and sensitive user data.\nThe vulnerability affects SiYuan versions 3.7.0 through 3.8.3. Version 3.8.4 and later are expected to contain the remediation for this defect. The exploitation requires the attacker to have the ability to modify content within the SiYuan database that the victim will later view. There are no authentication requirements within the application logic itself to trigger the rendering, as the vulnerability is inherent to the way the UI component processes existing database entries. The scope is limited to the desktop version using Electron; however, the impact is critical due to the transition from client-side script execution to system-level command execution facilitated by the enabled nodeIntegration setting."
}