Description

SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can inject malicious payloads through the setAttrViewColWidth API that break out of style attributes and inject event handlers on every table cell, executing arbitrary code in the Electron renderer with Node integration enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-08-15T22:16:54.330Z",
  "pubdate": "2026-08-15T22:16:54.330Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists in SiYuan versions prior to v3.7.4 due to inadequate validation and sanitization of table column width values. Attackers can leverage this flaw to inject malicious payloads via the setAttrViewColWidth API. The payload successfully breaks out of targeted style attributes and injects arbitrary event handlers into every table cell rendered within the application.\nBecause the affected application runs in an Electron renderer context with Node integration explicitly enabled, the successful execution of injected JavaScript results in arbitrary code execution on the underlying host system. This presents a critical risk to confidentiality, integrity, and availability, effectively granting an attacker full control over the user's local environment through the execution path of the desktop application.\nThe vulnerability requires the ability to interact with the internal setAttrViewColWidth API to store the malicious payload. Once stored, the payload executes automatically whenever the affected table view is rendered, requiring no further user interaction beyond triggering the view containing the malicious state.",
  "technicalDetails": "The root cause of this vulnerability is the improper input validation and insufficient output escaping of table column width values processed by the SiYuan application. Specifically, the vulnerable component fails to sanitize numerical or string inputs supplied to the setAttrViewColWidth API before reflecting them directly into Document Object Model (DOM) style attributes.\nThe exploitation method relies on stored cross-site scripting where an attacker injects a crafted string designed to break out of the enclosing HTML style attribute context. By escaping the attribute context, the attacker injects malicious event handlers across every table cell associated with the view. When the victim loads the affected document or view, the rendered DOM evaluates the injected attributes and executes the arbitrary script payload within the context of the Electron renderer process.\nThe attack flow proceeds in distinct sequential steps. First, the attacker invokes or interacts with the setAttrViewColWidth API, submitting a maliciously crafted column width value containing payload syntax designed to terminate style attributes and append event handlers. Second, the application persists this unsanitized value into the underlying data store without normalization or sanitization. Third, when a user accesses the table view, SiYuan retrieves the malicious configuration and renders the table cells, dynamically generating the HTML containing the unescaped payload within style attributes. Fourth, the browser rendering engine parses the markup, executes the injected event handlers, and triggers arbitrary code execution.\nThe vulnerable component involves the table column width handling logic and the setAttrViewColWidth API functions across SiYuan versions prior to v3.7.4. The environment exposure is local to the desktop application context, yet the post-exploitation impact is severe due to the architectural presence of Node integration enabled in the Electron renderer. This configuration permits malicious scripts to access native Node.js APIs, execute system commands, read or write local files, and completely compromise the host system under the privileges of the running application user."
}