Executive brief
SiYuan is an open-source knowledge management and note-taking application. Versions before 3.8.4 fail to properly escape bookmark labels when importing and displaying them in the interface, allowing attackers to execute malicious JavaScript code embedded in crafted notebook files. An attacker could use this to steal user data, manipulate notes, or gain unauthorized system access through command execution.
Technical details
This is a cross-site scripting (XSS) vulnerability in SiYuan's bookmark label rendering logic. The vulnerability exists because user-supplied HTML from bookmark attributes in .sy notebook files is not properly escaped before being rendered in the Electron application's DOM. An attacker can craft a malicious .sy file containing unescaped HTML/JavaScript in bookmark labels, which executes with the privileges of the Electron renderer process. Since the renderer has access to Node.js child_process module, successful exploitation allows arbitrary command execution on the host system. The vulnerability affects all versions before 3.8.4 and is fixed in that release.
Affected products
- SiYuan SiYuan before 3.8.4
Timeline
- 2026-09-17: disclosed