CyberRota Analysis
AI-GeneratedThe vulnerability affects SiYuan versions prior to 3.7.4, allowing attackers to exploit a cross-site scripting flaw in the file upload validation process. By crafting malicious filenames, an attacker can execute script payloads with full OS command access when users interact with the editor. Organizations using affected versions should prioritize patching to mitigate the risk of potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access when a user drags, drops, or pastes the file into the editor.