Executive brief
SiYuan, a personal knowledge management system and note-taking application, is vulnerable to a security flaw in its database (Attribute View) feature. An attacker can embed malicious code into a database cell that triggers when a user views the affected page. Because the desktop version of the application has high-level system access enabled, this flaw allows the attacker to take full control of the user's computer and execute arbitrary commands.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in SiYuan's Attribute View (database) component due to improper HTML escaping in the 'Template' and 'URL' column types. The backend 'HasUnclosedHtmlTag' check fails to identify balanced self-closing tags like <img>, allowing malicious payloads to be stored unescaped. On the frontend, 'renderCell' inserts these values into the DOM using 'innerHTML'. In the desktop application, where 'nodeIntegration' is enabled, an attacker can use this XSS to access Node.js 'require' and execute arbitrary system commands. The vulnerability is fixed in version 3.7.2.
Affected products
- siyuan-note SiYuan < 3.7.2
Timeline
- 2026-07-10: advisory: GHSA-pw5c-qhf3-jhwh published
- 2026-07-23: disclosed: NVD publication date
- 2026-07-23: patched: Fix confirmed in version 3.7.2