Executive brief
SiYuan is an open-source knowledge management application that uses an Electron-based desktop client. The application fails to validate clipboard content written by malicious websites, allowing attackers to inject and execute arbitrary code with Node.js privileges when users paste content into their notes. This could lead to complete system compromise, data theft, or unauthorized modifications of the user's workspace.
Technical details
The vulnerability is a code injection flaw in SiYuan's paste handler (paste.ts) that trusts the attacker-writable text/siyuan MIME type without sanitization. When a user visits a malicious webpage, the attacker can programmatically write malicious clipboard content using the custom MIME type. When the victim pastes this content into SiYuan, the application's renderer process executes the injected script with full Node.js access via the Electron main process, bypassing normal web security boundaries. The attack requires user interaction (pasting), but the malicious clipboard write can be triggered by merely visiting a compromised website. Fixed in version 3.8.2.
Affected products
- SiYuan SiYuan before 3.8.2
Timeline
- 2026-09-08: disclosed