Executive brief
SiYuan is a local-first personal knowledge management application. Versions before 3.8.4 fail to properly escape user-supplied input in Attribute View field descriptions, template sources, select option descriptions, and footer calculation templates. An authenticated attacker can inject malicious JavaScript that executes when other users open affected database menus, and in the Electron desktop application this leads to arbitrary command execution with SiYuan process privileges.
Technical details
The vulnerability is a stored XSS flaw in four textarea sink locations (col.ts, select.ts, and calc.ts) where user-controlled values are inserted into HTML without proper escaping. An incomplete prior fix for a related advisory left the oldDesc field in showColMenu() unescaped while three sibling textarea elements also remain vulnerable. An attacker with authentication can craft payloads that close the textarea tag and inject event handlers, executing arbitrary JavaScript in the renderer process; in the Electron app with nodeIntegration enabled and contextIsolation disabled, this allows Node.js module access and command execution.
Affected products
- SiYuan SiYuan 2.10.8 to 3.8.3
Timeline
- 2026-09-26: disclosed: Published as GHSA-h3p6-c22r-fx2j and CVE-2026-100643
- 2026-09-26: patched: Fixed in v3.8.4