SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.
The vulnerability lies in improper input sanitization in the asset cell renderer of the Attribute View, which is a database feature in SiYuan. An attacker can inject malicious JavaScript code that is permanently stored (stored XSS) and executed in the context of the Electron application. Because Electron combines a browser environment with access to Node.js and system APIs, script execution goes beyond the browser sandbox and allows arbitrary code execution on the victim's operating system.
An attacker can gain full control over the victim's system, including reading, modifying, and deleting data (C:H/I:H/A:H) and potentially performing actions outside the application context. The vulnerability also affects resources beyond the application (S:C — scope change).
SiYuan should be updated to version 3.7.0 or later, where the vulnerability has been fixed. The patch is available in the official project repository on GitHub.
SiYuan in versions earlier than 3.7.0, particularly the Electron-based desktop client.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H