Executive brief
SiYuan is a note-taking application that supports flashcard study features. An administrator who opens the flashcard manager in a workspace containing malicious flashcard content (created by an attacker through contribution or import) can have arbitrary code execute on their computer with full system access. The vulnerability stems from the application's failure to sanitize user-supplied flashcard content before displaying it in the card manager interface.
Technical details
Stored XSS in the flashcard card-manager view: the /api/riff/getRiffCards endpoint returns flashcard content that is unsafely interpolated into HTML markup via innerHTML assignment in app/src/card/viewCards.ts without HTML escaping. The Electron desktop application is configured with nodeIntegration enabled and contextIsolation disabled, allowing malicious JavaScript in the renderer process to achieve code execution with host privileges. Exploitation requires admin privileges and access to create or import flashcards into the target workspace.
Affected products
- SiYuan SiYuan before v3.8.4
Timeline
- 2026-09-26: disclosed
- 2026-07-29: patched: Fix appears to have been applied before official disclosure, likely in v3.8.4