Description

SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can set these metadata fields on a block can inject a self-firing payload (e.g. <img src=x onerror=...>) that executes automatically when a victim types '((' followed by a search term that surfaces the crafted block. Because SiYuan's Electron windows run with nodeIntegration enabled, contextIsolation disabled, and no CSP, the injected script gains require('child_process') access, allowing the XSS to escalate to arbitrary OS command execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-19T14:17:41.687Z",
  "pubdate": "2026-08-19T14:17:41.687Z",
  "executiveSummary": "SiYuan through version 3.7.3 suffers from a cross-site scripting (XSS) vulnerability located in the block-reference autocomplete hint popup feature.\nThe vulnerability arises due to the lack of proper output encoding when concatenating metadata fields into the generated HTML structure.\nAn authenticated or otherwise capable attacker who can control or set metadata fields such as a block's name, alias, or memo can inject malicious HTML and script payloads.\nBecause SiYuan operates as an Electron-based application configured with nodeIntegration enabled, contextIsolation disabled, and the complete absence of a Content Security Policy (CSP), an injected self-firing XSS payload executes with full privileges.\nConsequently, the successful exploitation of this flaw elevates from a standard browser-based XSS attack to arbitrary operating system command execution through direct access to Node.js modules like child_process.\nThe risk implications are severe, potentially leading to complete compromise of the local system hosting the affected SiYuan instance upon victim interaction.",
  "technicalDetails": "The root cause of the vulnerability resides in the genHintItemHTML function located within app/src/protyle/hint/extend.ts.\nWithin this vulnerable component, candidate block metadata fields including name, alias, and memo are concatenated directly into the HTML string of the autocomplete hint popup without prior sanitization or escaping.\nThe affected product is SiYuan through version 3.7.3, specifically impacting the block-reference autocomplete mechanism triggered when a user inputs the '((' sequence.\nThe step-by-step attack flow begins when an attacker crafts a malicious block containing an unescaped self-firing HTML/JavaScript payload (such as an <img src=x onerror=...> tag) within the name, alias, or memo fields.\nWhen a victim user types '((' followed by a specific search term that matches or surfaces the crafted block, the application invokes genHintItemHTML() to render the autocomplete hint popup.\nThe unsanitized metadata fields are parsed and rendered directly into the DOM, causing the injected payload to execute automatically within the context of the application without requiring additional user interaction beyond triggering the search hint.\nDue to the insecure architectural configuration of SiYuan's Electron runtime environment—specifically running with nodeIntegration enabled, contextIsolation disabled, and lacking a Content Security Policy (CSP)—the executing script bypasses standard browser security boundaries.\nThis grants the malicious script direct access to powerful Node.js APIs, allowing the execution of arbitrary operating system commands via require('child_process') and achieving full remote or local code execution under the security context of the user running the application."
}