Executive brief
SiYuan is a note-taking and knowledge management application available on desktop. The vulnerability allows attackers to inject malicious code through field descriptions and group names in database menus. When users open group, view, or field-edit menus, the unescaped stored data executes arbitrary code with full system access on the desktop client, enabling complete system compromise.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in HTML template interpolation. Six template locations in the database group, view, and field-edit menus fail to escape metadata values before assignment via innerHTML. Specifically, field descriptions and column names are properly escaped in HTML attributes but left unescaped in element bodies on the same line, allowing attackers to inject closing tags (e.g., </textarea>) and event handler markup. The vulnerability affects all SiYuan versions before v3.7.4. Exploitation requires user interaction (opening a menu) after an attacker injects malicious data via the API. The desktop client's Electron configuration enables nodeIntegration and disables contextIsolation, allowing injected scripts to access Node.js built-ins such as child_process, enabling arbitrary code execution with system privileges.
Affected products
- SiYuan SiYuan before v3.7.4
Timeline
- 2026-08-15: disclosed
- 2026-08-15: patched: v3.7.4 released