Executive brief
SiYuan is a note-taking application that allows users to annotate PDF documents. The application fails to validate or escape user-supplied annotation fields before writing them to disk and rendering them in the PDF viewer. An attacker can inject malicious markup into annotation fields, which executes as JavaScript with full Node.js access when a user opens an annotated PDF, potentially leading to complete system compromise.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the PDF annotation feature. The setFileAnnotation endpoint accepts a client-supplied annotation data string and writes it to a .sya sidecar file without validation or parsing. When a PDF is rendered, the showHighlight() function reads five fields (id, ids, mode, type, and color) from the annotation file and directly interpolates them into HTML attributes using insertAdjacentHTML() without escaping. An attacker can inject markup such as onerror event handlers into these fields. The payload persists in the .sya file and travels with the PDF through export, import, synchronization, and sharing. Because the Electron desktop application disables security features (nodeIntegration: true, contextIsolation: false, webSecurity: false), injected JavaScript gains access to Node.js built-ins including child_process, enabling arbitrary code execution. The vulnerability requires user interaction (opening a PDF) but no authentication to upload malicious annotations.
Affected products
- SiYuan SiYuan before v3.7.4
Timeline
- 2026-08-15: disclosed
- 2026-08-15: patched: v3.7.4