Executive brief
SiYuan is a popular open-source knowledge management and note-taking application. The desktop client allows users to create template-based database calculations. A critical flaw in the Template calculation feature fails to sanitize user-supplied markup, allowing attackers to inject malicious HTML and JavaScript code. When a database containing a malicious template calculation is opened in the desktop client, the injected code executes with full Node.js access, enabling complete system compromise including data theft and ransomware deployment.
Technical details
The vulnerability exists in SiYuan's Template calculation operator (kernel/av/calc_template.go), which renders user-authored Go templates server-side and returns the raw output without HTML sanitization. The client-side rendering code (app/src/protyle/render/av/calc.ts) assigns this untrusted output directly to innerHTML without escaping or validation. Unlike the separate template-column path which applies DOMPurify sanitization via getAVTemplateHTML(), the calculation path bypasses this protection entirely. Exploitation requires user privilege to create or modify a database template calculation, plus user interaction to open the affected database. The desktop Electron application enables nodeIntegration, disables contextIsolation, and sets webSecurity to false, allowing injected JavaScript to access Node.js primitives like require('child_process'). A proof-of-concept demonstrates injecting HTML event handlers (e.g., onerror attributes on img tags) that execute arbitrary code. Version 3.7.4 patches this by applying proper HTML sanitization to template calculation output.
Affected products
- SiYuan SiYuan before v3.7.4
Timeline
- 2026-08-15: disclosed
- 2026-08-15: patched: Version 3.7.4 available