Description
SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with full system access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| siyuan-note | siyuan | ≤ 3.8.4 | — |
References
- GitHub Security Advisory (GHSA-928g-4hfq-qwvx) vendor-advisory
- https://github.com/siyuan-note/siyuan product
- https://github.com/siyuan-note/siyuan/blob/v3.8.4/kernel/model/render.go#L71-L76 technical-description
- https://github.com/siyuan-note/siyuan/blob/v3.8.4/app/src/util/Tree.ts#L133 technical-description
- https://github.com/siyuan-note/siyuan/blob/v3.8.4/app/src/util/Tree.ts#L194 technical-description
- VulnCheck Advisory: SiYuan through 3.8.4 Stored XSS via Heading Style Attribute third-party-advisory