PT-2026-39288 · Siyuan · Siyuan
Curly-Haired-Baboon
·
Published
2026-05-08
·
Updated
2026-05-20
·
CVE-2026-44670
CVSS v4.0
9.4
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
SiYuan versions prior to 3.7.0
Description
The software fails to escape HTML when storing and rendering Attribute View (AV) names. The kernel stores these names without escaping and uses a raw string replacement to embed them in HTML before sending them to clients via WebSocket. This allows for HTML injection through three client paths:
render.ts (via outerHTML), Title.ts (via innerHTML), and transaction.ts (via innerHTML).Because the main BrowserWindow is configured with
nodeIntegration: true, contextIsolation: false, and webSecurity: false, this HTML injection can be escalated to Node.js code execution (RCE) on the victim's desktop. The payload is persistent, as it is stored on disk, replicates through sync transports (S3, WebDAV, cloud), and survives export-import processes. It can be triggered by any user role opening a document bound to the affected AV.Technical details include the use of the
/api/transactions endpoint with the setAttrViewName action to plant the payload. The vulnerability is reachable via local-origin requests, including those from allowlisted chrome-extension:// origins, allowing malicious browser extensions to execute the attack.Recommendations
Update to version 3.7.0.
As a temporary mitigation, restrict access to the
/api/transactions endpoint or avoid importing .sy.zip files from untrusted sources.Exploit
Fix
XSS
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Siyuan