Description

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts, getLeaf()/movePathTo()) used by the 'move/link to' path-selection dialogs, where document metadata fields (bookmark, alias, memo, and an alternate name field) are concatenated into the aria-label HTML attribute without escaping. A document crafted with a double quote in any of these fields breaks out of the attribute context and injects arbitrary HTML attributes including inline event handlers (e.g., onmouseover). Because every SiYuan Electron BrowserWindow runs with nodeIntegration:true, contextIsolation:false, and no CSP, the injected handler gains require('child_process') access, escalating the XSS to arbitrary OS command execution when a victim merely hovers over the malicious document entry in the path-picker dialog. Malicious documents reach victims via sharing, sync, or import.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-19T14:17:41.840Z",
  "pubdate": "2026-08-19T14:17:41.840Z",
  "executiveSummary": "A cross-site scripting (XSS) vulnerability exists in SiYuan before v3.7.4 within the file-tree picker's hover-tooltip generation mechanism, specifically in app/src/util/pathName.ts via getLeaf() and movePathTo().\nThe vulnerability allows an attacker to achieve arbitrary operating system command execution.\nAffected systems include SiYuan prior to version 3.7.4 running within its standard Electron architecture.\nThe risk implications are critical because the application runs with nodeIntegration:true, contextIsolation:false, and lacks a Content Security Policy (CSP).\nAn attacker can craft a malicious document containing a payload within metadata fields such as bookmark, alias, memo, or an alternate name field, which reaches victims via sharing, sync, or import.\nExploitation requires the victim to hover over the malicious document entry inside the path-selection dialog.",
  "technicalDetails": "The root cause of the vulnerability is the unsafe concatenation of document metadata fields directly into the aria-label HTML attribute without proper sanitization or context-aware escaping.\nThe vulnerable component is located in app/src/util/pathName.ts, specifically within the getLeaf() and movePathTo() functions used by 'move/link to' path-selection dialogs.\nAffected versions include all instances of SiYuan prior to v3.7.4.\nAuthentication and privilege requirements are minimal for the initial delivery, as malicious documents can be introduced via standard sharing, synchronization, or import mechanisms.\nNetwork exposure is local to the application instance, but delivery vectors rely on external sharing channels.\nThe attack flow begins when a malicious document is created with a double quote character embedded in one of the vulnerable metadata fields (bookmark, alias, memo, or alternate name).\nWhen the document is processed by the file-tree picker during 'move/link to' operations, the unescaped metadata breaks out of the aria-label attribute context.\nThis allows the injection of arbitrary HTML attributes, including inline event handlers such as onmouseover.\nBecause every SiYuan Electron BrowserWindow is initialized with nodeIntegration:true, contextIsolation:false, and no CSP, the resulting XSS is not restricted to standard browser DOM limitations.\nWhen a victim hovers over the malicious document entry in the path-picker dialog, the injected onmouseover event handler executes.\nThe payload leverages the exposed Node.js environment to access require('child_process'), immediately escalating the XSS into arbitrary OS command execution under the privileges of the user running the SiYuan application."
}