SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (database) cell renderer genAVValueHTML interpolates cell content raw in four of its branches: text, url, phone, and mAsset. A cell value like </textarea><img src=x onerror="..."> or "><img src=x onerror="..."> breaks out of its surrounding tag and runs arbitrary JavaScript in the renderer when the victim opens the block-attribute panel. On Electron desktop the renderer runs with nodeIntegration:true, so the XSS chains to host RCE via require('child_process'). AV files live under the workspace and ride normal sync, so an attacker with write access to any synced workspace plants the payload once and it fires on every device that opens a panel containing that row.he kernel doesn't escape on the way in either, so the malicious cell persists byte-for-byte. There's no equivalent of the html.EscapeAttrVal call that protects block IAL attributes at kernel/model/blockial.go:261. This vulnerability is fixed in 3.7.0.
The database cell renderer (genAVValueHTML) inserts the contents of cells of types text, url, phone and mAsset directly into the generated HTML without any escaping. An attacker can place a payload such as </textarea><img src=x onerror="..."> in a cell value, which breaks out of the surrounding tag and executes arbitrary JavaScript when the victim opens the block attributes panel. Since the kernel layer also does not sanitize data on write, the malicious value is stored and synchronized unchanged to all devices using the same workspace. On the Electron desktop version with the nodeIntegration:true flag enabled, XSS enables direct invocation of require('child_process'), which translates to full RCE on the host.
An attacker with write access to a synchronized workspace can place a payload once that will execute on every victim device opening a panel with an infected row — on Electron desktop the result is full operating system takeover (RCE), while in a browser context — arbitrary JavaScript execution in the victim's session.
SiYuan should be updated to version 3.7.0 or newer, which introduces proper cell value escaping in the genAVValueHTML renderer. It is also recommended to review synchronized workspaces for the presence of malicious payloads in database cells.
SiYuan in versions earlier than 3.7.0 (all platforms using the attribute-view renderer); particularly vulnerable is the desktop version based on Electron with the nodeIntegration:true option enabled
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H