Executive brief
SiYuan is a knowledge management and note-taking application that stores and displays user notebooks. The application fails to properly escape notebook names when rendering them in a dialog picker, allowing an attacker to create a notebook with malicious code in its name that executes when the Daily Note picker opens. Since SiYuan runs as an Electron desktop application with Node.js access, successful exploitation enables remote command execution on the user's system.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Electron renderer where notebook names are rendered as raw HTML without sanitization in the Daily Note picker dialog. An attacker can craft a notebook with HTML/JavaScript payloads in the name that execute in the Electron context with Node.js permissions when the picker is opened. This allows arbitrary operating system command execution on the victim's machine.
Affected products
- SiYuan Note SiYuan through 3.8.4
Timeline
- 2026-09-19: disclosed