CyberRota Analysis
AI-GeneratedSiYuan versions up to 3.7.3 are vulnerable to a cross-site scripting (XSS) flaw that allows an attacker to inject malicious scripts into the block-reference autocomplete hint popup. This vulnerability can lead to arbitrary OS command execution due to the application's Electron environment, which has nodeIntegration enabled and contextIsolation disabled. Organizations using SiYuan should prioritize patching this issue to mitigate the risk of exploitation and potential system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can set these metadata fields on a block can inject a self-firing payload (e.g. <img src=x onerror=...>) that executes automatically when a victim types '((' followed by a search term that surfaces the crafted block. Because SiYuan's Electron windows run with nodeIntegration enabled, contextIsolation disabled, and no CSP, the injected script gains require('child_process') access, allowing the XSS to escalate to arbitrary OS command execution.