CyberRota Analysis
AI-GeneratedSiYuan versions prior to 3.8.2 are vulnerable due to inadequate sanitization of the attacker-writable clipboard MIME type, enabling remote code execution through malicious web pages. This flaw allows attackers to inject scripts that execute with full Node.js privileges in the Electron main process upon pasting into the application. Organizations using SiYuan should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected scripts execute with full Node.js access through the Electron main process.