Description

SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitrary code via event handlers, reaching Node built-ins due to Electron's insecure configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-08-15T22:16:54.030Z",
  "pubdate": "2026-08-15T22:16:54.030Z",
  "executiveSummary": "SiYuan before v3.7.4 suffers from an improper neutralization of input during web page generation vulnerability, specifically involving database menu metadata and HTML interpolation. This flaw allows stored values to execute arbitrary scripts when users interact with specific application interfaces, such as opening group, view, or field-edit menus.\nThe vulnerability enables attackers to inject malicious markup, including HTML tags and event handlers, through vulnerable entry points like field descriptions or names. When rendered, these inputs prematurely close containing elements and execute arbitrary code within the context of the application.\nBecause the affected application is built on Electron with an insecure configuration, the successfully executed arbitrary code can reach Node.js built-ins and underlying system capabilities. This escalates the severity from a standard cross-site scripting issue to potential full system compromise, depending on the privileges of the user running the application.\nExploitation requires the attacker to inject malicious data into database menu metadata fields, which is subsequently triggered through standard user interaction with the application menus. No specialized authentication bypass is detailed, relying instead on stored injection vectors.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure handling and lack of proper sanitization or context-aware escaping of database menu metadata during HTML interpolation in SiYuan before v3.7.4. The application dynamically generates HTML content using stored user-supplied strings from database configurations without sufficiently neutralizing dangerous characters and markup sequences.\nThe vulnerable components include the rendering logic responsible for displaying database group, view, and field-edit menus. Specifically, fields such as database field descriptions and names accept and store input that is later rendered directly into the Document Object Model (DOM) via insecure HTML interpolation.\nAn attacker exploits this behavior by crafting a malicious payload within the database field names or descriptions. This payload typically includes closing HTML tags (such as '>') to prematurely terminate the existing containing element, followed by the insertion of malicious script content or event handlers (such as onerror, onload, or onclick attributes).\nThe attack flow proceeds as follows: First, the attacker introduces the malicious markup into a database metadata field, either locally or through a synchronization mechanism where stored data is accepted. Second, the victim navigates the application and interacts with the database interface by opening a group, view, or field-edit menu. Third, the application interpolates the unescaped database metadata into the HTML template during DOM generation. Fourth, the injected markup breaks out of the intended context, causing the browser to parse and execute the attacker-supplied JavaScript payload.\nDue to Electron's insecure configuration—specifically the lack of proper context isolation, enabling nodeIntegration, or failing to disable dangerous renderer capabilities—the executing script is not bound by standard web browser sandboxing constraints. Instead, the malicious script gains access to Node.js built-in modules and execution APIs.\nThe post-exploitation impact is severe, as the execution of arbitrary JavaScript with Node.js integration allows for arbitrary command execution on the host operating system, file system access, and data exfiltration under the security context of the user running SiYuan."
}