Executive brief
SiYuan is an open-source personal knowledge management system. A security vulnerability in how the application handles asset links allows an attacker to execute malicious code on a user's computer if the user clicks a specially crafted link. This could lead to a full system compromise, including the theft of sensitive data or the installation of malware, because the application's desktop version lacks standard security sandboxing.
Technical details
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in SiYuan's Asset.render() method within app/src/asset/index.ts. The application fails to sanitize the 'this.path' property before interpolating it into HTML template literals assigned to innerHTML. An attacker can use a double quote character to break out of the 'src' attribute and inject event handlers like 'onerror'. Because the Electron renderer is configured with 'nodeIntegration: true' and 'contextIsolation: false', and lacks a Content Security Policy (CSP), this XSS allows for direct execution of Node.js commands (e.g., via child_process.exec), resulting in Remote Code Execution (RCE). The issue is fixed in version 3.7.1 by escaping the asset path before HTML insertion.
Affected products
- siyuan-note SiYuan < 3.7.1
Timeline
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-04: patched: Version 3.7.1 released
- 2026-07-09: disclosed: CVE published to NVD