Description

SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node integration enabled in the desktop client enabling code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-08-15T22:16:55.017Z",
  "pubdate": "2026-08-15T22:16:55.017Z",
  "executiveSummary": "A DOM-based Cross-Site Scripting (XSS) vulnerability exists in SiYuan before v3.7.4, specifically within the attribute-view sort menu component.\nThe flaw stems from the insecure handling of database field names, which are stored without proper HTML escaping and subsequently interpolated directly into option elements via the innerHTML property.\nAn attacker capable of modifying database field names can inject arbitrary HTML and malicious markup payloads.\nWhen a user interacts with the affected sort menu, the injected script executes within the context of the application.\nBecause the desktop client operates with Node integration enabled, successful exploitation escalates from standard XSS to arbitrary code execution on the underlying host system.\nThe risk implication is severe, transitioning from client-side script execution to potential full system compromise depending on the user's operating environment.",
  "technicalDetails": "The vulnerability resides in the attribute-view rendering logic of SiYuan before v3.7.4, specifically where attribute-view field names are processed and displayed inside the sort menu.\nThe root cause of the vulnerability is the lack of context-aware output encoding or HTML sanitization for database field names prior to DOM insertion.\nInstead of utilizing safe DOM manipulation methods such as textContent or properly escaping special characters, the application directly assigns the unescaped field name strings via the innerHTML property of option elements.\nThis improper input handling allows malicious markup, including script tags or event handlers, to be persisted within the database schema and subsequently rendered as active HTML.\nThe step-by-step attack flow begins when an attacker renames a database field to include a crafted HTML/JavaScript payload.\nThe payload remains dormant until a victim opens the attribute-view sort menu within the application interface.\nUpon opening the menu, the vulnerable component parses the innerHTML containing the attacker-controlled database field name, causing the browser to parse and execute the embedded JavaScript payload.\nIn the context of the SiYuan desktop client, Node integration is enabled, which exposes powerful Node.js APIs to the renderer process.\nConsequently, the execution of arbitrary JavaScript within the desktop application context grants the attacker the ability to interact with the underlying operating system, read or write local files, and execute arbitrary system commands.\nAuthentication and privilege requirements depend on the specific deployment, but typically require the ability to create or modify database structures within the application workspace."
}