Summary
SiYuan contains a stored cross-site scripting vulnerability in several Attribute View values that are rendered without adequate escaping. An authenticated attacker who can modify affected descriptions or templates may cause JavaScript to execute when another user opens the impacted database interface; in the Electron desktop application, this may extend to command execution when Node integration is enabled.
Affected context
The issue can occur in SiYuan deployments where authenticated users can edit Attribute View field descriptions, template sources, select option descriptions, or footer calculation templates, and those values are later inserted into textarea elements without sufficient contextual escaping. Risk is greater in the Electron desktop application when Node integration exposes additional process capabilities.
Exploit preconditions
- Attack surface: SiYuan database menus and Attribute View interfaces - Required access: An authenticated account with permission to modify
affected field or template values
- Trigger point: Another user opens a database menu containing the stored
value
- Execution context: The injected content is interpreted by the affected
interface rather than rendered strictly as text
- Elevated consequence: In the Electron application, Node integration must
be enabled for browser-script execution to potentially reach operating
system command capabilities
Why this happens
The underlying bug is a failure to apply context-appropriate output encoding when storing and rendering attacker-influenced Attribute View values inside textarea elements. This permits markup or script content to cross the intended data-to-code boundary and execute in a user's browser context, corresponding to CWE-79, Improper Neutralization of Input During Web Page Generation. The risk is amplified when the desktop runtime exposes Node integration to renderer processes.
Potential impact
- Stored JavaScript may execute in the context of users viewing affected database menus.
- An attacker could potentially perform actions available to the victim's SiYuan session.
- Session information or accessible application data could be exposed.
- The Electron application may permit command execution with SiYuan process privileges when Node integration is enabled.
- Malicious content could affect the integrity of shared database views and templates.
General mitigation guidance
Mitigation generally centers on treating all user-controlled Attribute View values as untrusted and applying context-aware output encoding at every rendering boundary. Secure-by-default designs should render descriptions and template metadata as inert text unless a narrowly defined, sanitized markup feature is required. Where markup is supported, allowlisting and sanitization should be applied before rendering, while template execution should be isolated from ordinary display fields. Electron deployments should minimize renderer privileges, avoid Node integration where it is not required, and apply least-privilege operating-system permissions. Access controls can also reduce which users may modify shared view definitions.
How teams detect issues like this
Detection can include static analysis for direct insertion of untrusted Attribute View values into HTML or DOM sinks, especially textarea and template-rendering paths. Code review should examine every field that accepts descriptions, template sources, option metadata, or calculated footer content, and verify contextual encoding at output time. Dynamic testing can use benign marker strings to confirm that stored values remain text in all affected interfaces. Policy enforcement may require output encoding libraries, sanitizer allowlists, and Electron configurations that prohibit unnecessary Node integration. Automated security review tools can help identify dangerous DOM sinks and missing escaping.
