Description
SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, attackers can inject JavaScript that calls Node.js child_process APIs to execute arbitrary commands with user privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| siyuan-note | siyuan | 3.7.0 – < 3.8.4 | 3.8.4 |
References
- GitHub Security Advisory (GHSA-556j-q8c8-qqg3) vendor-advisory
- VulnCheck Advisory: SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban third-party-advisory