Description

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in the desktop client renderer with Node integration enabled, allowing arbitrary code execution when the database is opened.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-08-15T22:16:54.200Z",
  "pubdate": "2026-08-15T22:16:54.200Z",
  "executiveSummary": "A remote code execution vulnerability exists in SiYuan versions prior to v3.7.4 within the Template calculation operator. The vulnerability arises from the insecure rendering of user-authored Go templates where output is stored verbatim without proper sanitization. Attackers capable of injecting malicious HTML and JavaScript payloads into template calculations can achieve arbitrary code execution.\nThe impact of this vulnerability is critical, as SiYuan desktop client renderers operate with Node integration enabled. This architectural configuration allows malicious payloads executed within the context of the application to execute arbitrary system commands and access local resources.\nExploitation requires the attacker to introduce a malicious template into the database, which subsequently executes when the database is opened by a victim using an affected desktop client version. This grants the attacker the execution privileges of the local user running the SiYuan application.\nThe risk implication is severe, potentially leading to complete compromise of the host system running the SiYuan desktop client. Organizations and individuals utilizing affected versions must update immediately to mitigate the risk of unauthorized code execution resulting from malicious database files or shared templates.",
  "technicalDetails": "The root cause of the vulnerability resides in the Template calculation operator of SiYuan, which is responsible for evaluating and rendering user-authored Go templates. During this process, the application renders the template and stores the resulting output verbatim into the database without implementing robust output sanitization or contextual encoding mechanisms.\nThe vulnerable component is the template rendering and calculation engine within SiYuan versions prior to v3.7.4. Because the application processes and persists the unvalidated template output, malicious syntax is retained within the data structures of the database.\nExploitation occurs when an attacker crafts a malicious Go template incorporating arbitrary HTML and JavaScript payloads and inserts it into a SiYuan database. The attack flow proceeds as follows: first, the attacker introduces the malicious template into the target database file or induces a user to import/open a compromised database. Second, when the SiYuan desktop client opens the database and processes the template calculation operator, the unsanitized payload is rendered.\nBecause the SiYuan desktop client renderer is configured with Node integration enabled, the execution environment possesses access to Node.js APIs and underlying operating system functions. Consequently, when the malicious JavaScript payload is evaluated within the renderer context, it escapes standard web sandbox limitations and executes arbitrary system commands with the privileges of the user running the SiYuan desktop client.\nThe vulnerability requires the victim to open the compromised database containing the malicious template calculation. Authentication and privilege requirements depend on the distribution vector of the database file, but successful exploitation yields full post-exploitation impact consistent with local code execution on the host operating system."
}