Executive brief
SiYuan is a note-taking and knowledge management application used for organizing documents and references. A flaw in versions before 3.8.1 allows attackers to inject malicious HTML and JavaScript code into block names, aliases, and memo fields. When other users view documents that reference these blocks—such as through hints, backlinks, or breadcrumbs—the injected code executes in their browser, potentially compromising user data or enabling account takeover.
Technical details
This is a stored cross-site scripting (XSS) vulnerability (CWE-79) stemming from improper HTML escaping in three rendering functions: genHintItemHTML() in hint/extend.ts, renderBacklink() in renderBacklink.ts, and breadcrumb rendering in breadcrumb/index.ts. The root cause is a regression in commit e0315dd8 that removed escapeHtml() calls introduced in an earlier fix, combined with two additional vulnerable code paths that were never patched. Block name, alias, and memo fields are interpolated directly into HTML templates without sanitization, allowing attackers to inject arbitrary HTML and JavaScript that executes when referenced blocks are displayed in hints, backlink panels, or document breadcrumbs. The vulnerability affects SiYuan versions from 3.7.4 through 3.8.0 and is patched in v3.8.1. Attack requires the ability to modify block properties (via the application itself or imported/shared documents) and that another user view a document referencing the malicious block.
Affected products
- SiYuan SiYuan < 3.8.1
Timeline
- 2026-08-30: disclosed
- 2026: patched: Patched in v3.8.1