Executive brief
SiYuan, a personal knowledge management system, is vulnerable to a critical security flaw that allows an attacker to execute arbitrary code on a user's computer. By tricking the application into displaying a specially crafted document title or metadata (for example, through a shared file or search result), an attacker can gain full control over the victim's system. This could lead to the theft of sensitive files, such as SSH keys and cloud credentials, or the installation of malware.
Technical details
The vulnerability exists in the tooltip mouseover handler within `app/src/block/popover.ts`. While the application attempts to escape HTML special characters in `aria-label` attributes using `escapeAriaLabel`, it fails to account for URL-encoded characters. The consumer side calls `decodeURIComponent` on the attribute value before assigning it to `innerHTML` in `app/src/dialog/tooltip.ts`, which converts URL-escaped tags (e.g., %3C) into literal HTML tags. Because the Electron renderer is configured with `nodeIntegration: true` and `contextIsolation: false`, an attacker can leverage this XSS to access Node.js primitives like `child_process` to achieve arbitrary code execution. This bypasses the fix for CVE-2026-34585.
Affected products
- siyuan-note SiYuan <= 3.6.5
Timeline
- 2026-05-05: advisory: GHSA-25rp-h46x-2hjm published
- 2026-05-08: disclosed: CVE-2026-44588 assigned
References
- https://api.github.com/users/Curly-Haired-Baboon
- https://github.com/Curly-Haired-Baboon
- https://api.github.com/users/Curly-Haired-Baboon/gists%7B/gist_id%7D
- https://api.github.com/users/Curly-Haired-Baboon/repos
- https://avatars.githubusercontent.com/u/227850795?v=4
- https://api.github.com/users/Curly-Haired-Baboon/events%7B/privacy%7D