Executive brief
SiYuan, a personal knowledge management system, contains a security flaw in how it handles cover images for Gallery and Kanban views. An attacker with permission to edit documents can embed malicious code into a document's image properties. When another user opens that document, the code executes automatically, allowing the attacker to take full control of the victim's computer, including the ability to access files and run unauthorized programs.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in SiYuan's Attribute-View feature due to improper neutralization of the 'title-img' Individual Attribute List (IAL) value. The application fails to properly escape this value before interpolating it into a 'style' attribute within an <img> tag in 'kernel/sql/av_gallery.go' and 'av_kanban.go'. Because the desktop application is built on Electron with 'nodeIntegration' enabled and 'contextIsolation' disabled, an attacker with editor permissions can inject an 'onload' handler to execute arbitrary Node.js commands on the host OS. The vulnerability is triggered automatically when a victim views a document containing the malicious IAL. This issue was patched in version 3.7.2.
Affected products
- siyuan-note SiYuan < 3.7.2
Timeline
- 2026-07-14: advisory: GitHub Security Advisory published
- 2026-07-27: disclosed: NVD publication date
- 2026-07-27: patched: Vendor fix confirmed in v3.7.2