SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, Mermaid diagrams are rendered with securityLevel set to "loose", and the resulting SVG is injected into the DOM via innerHTML. This allows attacker-controlled javascript: URLs in Mermaid code blocks to survive into the rendered output. On desktop builds using Electron, windows are created with nodeIntegration enabled and contextIsolation disabled, escalating the stored XSS to arbitrary code execution when a victim opens a note containing a malicious Mermaid block and clicks the rendered diagram node. This issue has been fixed in version 3.6.4.
The Mermaid library is configured with the securityLevel parameter set to 'loose', which causes the generated SVG code to be injected into the DOM via innerHTML without proper sanitization. This allows malicious javascript: URLs to persist in the rendered output (stored XSS). On the desktop platform, Electron windows are created with nodeIntegration enabled and contextIsolation disabled, which removes the security boundary between JavaScript code and Node.js API. As a result, when the victim opens a note with a malicious Mermaid block and clicks a rendered diagram node, arbitrary code is executed with the permissions of the application process.
An attacker can gain full control of the victim's system — execute arbitrary code in the context of the Electron process with access to Node.js API, enabling file read/write operations, execution of system commands, and further lateral movement in the victim's environment.
Update SiYuan to version 3.6.4, in which the vulnerability has been fixed. The patch is available in the official GitHub repository at https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4
B3Log SiYuan in versions 3.6.3 and earlier, particularly in Electron-based desktop builds (Windows, macOS, Linux).
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HB3log Siyuan
APPB3Log< 3.6.4
Related vulnerabilities
RCE przez stored XSS w kliencie desktopowym B3Log SiYuan
RCE w SiYuan poprzez nadmiernie permisywną politykę CORS
Stored XSS → RCE w B3Log SiYuan via złośliwy URL w Attribute View
Path Traversal w B3Log SiYuan — nieautoryzowane odczytywanie struktury plików
B3Log SiYuan — nieuprawniony odczyt treści dokumentów przez API