Description

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-08-15T22:16:53.883Z",
  "pubdate": "2026-08-15T22:16:53.883Z",
  "executiveSummary": "SiYuan versions prior to v3.7.4 contain an input validation and sanitization vulnerability within the setFileAnnotation endpoint. The flaw enables attackers to inject malicious markup payloads into annotation fields stored directly to disk. When a user subsequently opens a locally modified or maliciously crafted PDF document, the embedded payload is parsed and executed within the context of the integrated PDF renderer. This vulnerability poses severe risk implications, as execution occurs with full Node.js environment privileges. Consequently, a successful exploit grants an attacker arbitrary code execution capabilities on the host operating system under the security context of the running application instance. Exploitation requires the target user to open an annotated PDF containing the malicious markup injected via the vulnerable endpoint.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and a lack of proper output escaping within the setFileAnnotation endpoint of SiYuan. When processing file annotations, the application fails to sanitize strings designated for storage in annotation fields written to disk. As a result, arbitrary markup containing executable script structures can be injected directly into the persisted annotation metadata without prior filtration.\nThe vulnerable component is the internal PDF renderer mechanism responsible for interpreting and displaying annotation objects. Affected versions include all iterations of SiYuan prior to v3.7.4. The attack vector involves writing malicious payloads via the setFileAnnotation function, which persists the input onto the underlying filesystem. When a user triggers the rendering of the annotated PDF document, the rendering engine processes the unescaped annotation fields.\nThe step-by-step attack flow proceeds as follows: First, an attacker leverages the setFileAnnotation endpoint to write malicious markup containing script payloads into the target document's annotation parameters. Second, the crafted annotations are serialized and saved to disk. Third, the victim user opens the affected PDF within the SiYuan application. Fourth, the PDF renderer parses the stored annotation fields, inadvertently evaluating the injected markup. Finally, because the rendering context is improperly isolated and operates with full Node.js access, the payload executes arbitrary JavaScript capable of interacting with system modules, leading to complete compromise of the local environment."
}