Executive brief
SiYuan is a personal knowledge management system used to organize notes and documents. A security flaw in how the application handles note previews and community-contributed packages allows an attacker to embed malicious code. If a user views a specially crafted note or a malicious package README and clicks a link within it, the attacker can gain full control over the user's computer, potentially leading to data theft or the installation of malware.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in SiYuan due to an incomplete URL-scheme allowlist in the Lute rendering engine's sanitizer. While Lute blocks 'javascript:' schemes in common attributes like 'href', it fails to check 'form action' or SVG 'xlink:href' attributes. When these attributes are rendered in the document export-preview or Bazaar package README paths, they bypass sanitization. Because the SiYuan Electron desktop application is configured with 'nodeIntegration: true' and 'contextIsolation: false', an attacker can use the XSS to access Node.js primitives (e.g., 'require') and execute arbitrary OS commands. The issue is fixed in version 3.7.1 by updating the Lute engine.
Affected products
- siyuan-note SiYuan < 3.7.1
Timeline
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-04: patched: Version 3.7.1 released
- 2026-07-09: disclosed: CVE published to NVD