Description
SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node integration enabled in the desktop client enabling code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| siyuan-note | siyuan | < 3.7.4 | 3.7.4 |
References
- GitHub Security Advisory (GHSA-g3jx-227v-x2x4) vendor-advisory
- VulnCheck Advisory: SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names third-party-advisory