CyberRota Analysis
AI-GeneratedThe vulnerability affects the SiYuan application prior to version 3.7.2, specifically in the handling of the siyuan:// protocol, which allows for cross-site scripting (XSS) that can escalate to arbitrary command execution on the operating system. This occurs when a non-existent plugin link is processed, leading to the injection of malicious JavaScript due to improper input sanitization. Organizations using SiYuan, especially those with sensitive data or systems, should prioritize patching this critical vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it (app/src/layout/Tab.ts), allowing injection of an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node's require and call require('child_process').execSync(...), escalating the cross-site scripting into arbitrary operating-system command execution.