Description

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-09-02T12:17:17.183Z",
  "pubdate": "2026-09-02T12:17:17.183Z",
  "executiveSummary": "SiYuan versions prior to 3.8.2 are susceptible to a stored Cross-Site Scripting (XSS) vulnerability within the application's asset serving mechanism. This security flaw stems from an insufficiently restrictive blocklist for file extensions, which fails to account for file types that the browser interprets as executable content.\nBy uploading malicious files with extensions such as .xht, .ehtml, .xsl, .xbl, or .rdf, an attacker can bypass existing security controls and force the application to serve files with media types that support JavaScript execution. This allows for the injection of arbitrary scripts that execute within the context of the user's session.\nThe impact of this vulnerability is severe, as it facilitates the exfiltration of sensitive information, including API tokens, and allows for unauthorized access to or compromise of the user's workspace. Successful exploitation requires the ability to upload assets to the SiYuan environment, but does not necessitate advanced privileges beyond standard file upload capabilities. Users are at risk of complete account takeover if their session tokens are compromised via the injected malicious scripts.",
  "technicalDetails": "The root cause of this vulnerability is an incomplete server-side validation mechanism tasked with filtering file uploads. While SiYuan implements a blocklist to prevent the upload of potentially dangerous file extensions, the list is insufficient as it fails to include several extensions that are natively interpreted by web browsers as XML-based documents or other formats capable of triggering XSS.\nThe vulnerability resides in the component responsible for serving uploaded assets. When a file is accessed via the application's internal URL scheme, the server serves the content with a MIME type that the browser interprets based on the file's extension. Because the blocklist misses extensions like .xht (XHTML), .ehtml (Embedded HTML), .xsl (Extensible Stylesheet Language), .xbl (XML Binding Language), and .rdf (Resource Description Framework), the server may assign these files media types that allow the browser to parse and execute embedded scripts.\nThe attack flow follows a structured process: First, the attacker crafts a malicious file containing a payload designed to access browser cookies, localStorage, or API tokens stored by SiYuan. Second, the attacker uploads this file as an asset to the workspace, potentially disguising it as a document or data file. Third, the attacker triggers access to the uploaded file URL. When the victim accesses this URL, the browser retrieves the file from the SiYuan asset server. Because the server does not enforce a secure 'Content-Type' or 'Content-Disposition: attachment' header policy, the browser renders the file and executes the malicious script embedded within the XML/HTML structure.\nThis execution occurs within the security origin of the SiYuan application, granting the injected script full access to the Document Object Model (DOM), local storage, and cookies associated with the workspace. The payload is typically designed to exfiltrate sensitive data, such as API credentials, to an attacker-controlled remote server. Given that SiYuan often manages sensitive user notes and potentially authenticated connections, the post-exploitation impact includes the total compromise of the user's workspace, unauthorized data access, and potential persistence mechanisms within the local application state."
}