PT-2026-29376 · Siyuan · Siyuan
Ngocnn97
·
Published
2026-03-31
·
Updated
2026-04-03
·
CVE-2026-34448
CVSS v3.1
9.0
Critical
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
SiYuan versions prior to 3.6.2
Description
SiYuan is a personal knowledge management system susceptible to a stored cross-site scripting (XSS) issue. An attacker can inject a malicious URL into an Attribute View
mAsse field. When a victim opens the Gallery or Kanban view with “Cover From -> Asset Field” enabled, the malicious URL is executed. The vulnerable code accepts arbitrary http(s) URLs without extensions as images, stores the attacker-controlled string in coverURL, and injects it directly into an <img src="..."> attribute without proper escaping. In the Electron desktop client, the injected JavaScript executes with nodeIntegration enabled and contextIsolation disabled, leading to arbitrary OS command execution under the victim’s account. The vulnerable flow involves the IsPossiblyImage(assetPath) function accepting unsafe image URLs and the direct insertion of coverURL into the HTML without escaping. A payload such as https://example.com/" onerror="require('child process').exec('calc') can be used to trigger the XSS.Recommendations
Versions prior to 3.6.2 should be updated to version 3.6.2 or later.
Exploit
Fix
RCE
Code Injection
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Siyuan