Executive brief
SiYuan, a personal knowledge management system, is vulnerable to a security flaw where malicious code can be embedded in database names. If a user views a document containing a specially crafted database name, an attacker can gain full control over the user's computer. This can lead to the theft of sensitive files, installation of malware, or complete loss of data privacy.
Technical details
A stored XSS vulnerability exists in SiYuan's kernel where Attribute View (AV) names are stored and rendered without HTML escaping. The kernel uses raw string replacement to embed these names into HTML templates, which are then consumed by the Electron renderer via sinks like outerHTML and innerHTML. Because the Electron BrowserWindow is configured with nodeIntegration:true and contextIsolation:false, an attacker can escalate from HTML injection to arbitrary Node.js code execution. The vulnerability can be triggered remotely via malicious browser extensions (due to an allowlisted chrome-extension:// origin), shared workspace files, or sync replication. A patch is available in version 0.0.0-20260512140701-d7b77d945e0d.
Affected products
- siyuan-note SiYuan <= 3.6.5
Timeline
- 2026-05-04: advisory: GitHub Advisory published
- 2026-05-08: disclosed: CVE-2026-44670 assigned
- 2026-05-12: patched: Fixed in kernel version 0.0.0-20260512140701-d7b77d945e0d
References
- https://api.github.com/users/Curly-Haired-Baboon
- https://github.com/Curly-Haired-Baboon
- https://api.github.com/users/Curly-Haired-Baboon/gists%7B/gist_id%7D
- https://api.github.com/users/Curly-Haired-Baboon/repos
- https://avatars.githubusercontent.com/u/227850795?v=4
- https://api.github.com/users/Curly-Haired-Baboon/events%7B/privacy%7D