Executive brief
SiYuan is a personal knowledge management system used for organizing notes and data. A security flaw allows an attacker to embed malicious code within a database field that, when viewed by another user in specific layouts like Gallery or Kanban, can take over the victim's computer. In the desktop version of the application, this could lead to the unauthorized execution of system commands, potentially resulting in data theft or full system compromise.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan's Attribute View rendering. The application fails to sanitize URLs in the 'mAsse' field when used as a cover image in Gallery or Kanban views. Specifically, the 'IsPossiblyImage' function accepts arbitrary HTTP(S) URLs, which are then injected directly into an <img> tag's 'src' attribute without escaping. An attacker can use a payload to break out of the attribute and inject an 'onerror' handler. In the Electron-based desktop client, 'nodeIntegration' is enabled and 'contextIsolation' is disabled, allowing the injected JavaScript to access Node.js APIs and execute arbitrary OS commands. This has been patched in version 3.6.2.
Affected products
- siyuan-note SiYuan < 3.6.2
Timeline
- 2026-03-18: other: Issue reported to vendor
- 2026-03-28: advisory: Vendor security advisory published
- 2026-03-31: patched: Version 3.6.2 released
- 2026-03-31: disclosed: CVE-2026-34448 published