CVE-2026-75916 in SiYuan
Summary
by MITRE • 08/19/2026
SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can set these metadata fields on a block can inject a self-firing payload (e.g. <img src=x onerror=...>) that executes automatically when a victim types '((' followed by a search term that surfaces the crafted block. Because SiYuan's Electron windows run with nodeIntegration enabled, contextIsolation disabled, and no CSP, the injected script gains require('child_process') access, allowing the XSS to escalate to arbitrary OS command execution.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in SiYuan versions through 3.7.3 represents a critical security flaw rooted in improper input validation and output encoding within the application's user interface layer. Specifically, the defect resides in the genHintItemHTML function located in the app/src/protyle/hint/extend.ts source file. This component is responsible for generating HTML content for autocomplete hints that appear when users invoke block references using the double parenthesis syntax. The core technical failure involves the direct concatenation of unescaped user-controlled data, including a candidate block's name, alias, and memo fields, directly into the resulting HTML structure. By failing to sanitize or encode these metadata strings before insertion, the application allows arbitrary script injection if an attacker can control any part of this metadata. This is classified under CWE-79 as Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting.
The operational impact of this vulnerability extends far beyond typical client-side data theft due to the specific runtime environment in which SiYuan operates. The application utilizes an Electron framework architecture where nodeIntegration is enabled and contextIsolation is disabled for certain windows. Furthermore, there are no Content Security Policy restrictions applied to these contexts. Consequently, when a victim user types the trigger sequence followed by a search term that surfaces a block with maliciously crafted metadata, the injected script executes automatically without requiring any additional interaction from the user. Because nodeIntegration allows JavaScript code running in the renderer process to access Node.js APIs directly, the executed payload gains full access to system-level functions. This includes the ability to invoke require('child_process'), which permits the execution of arbitrary operating system commands with the privileges of the currently logged-in user.
This escalation path transforms a standard cross-site scripting issue into a Remote Code Execution vulnerability. An attacker does not need complex social engineering or file upload capabilities; they only need the ability to set metadata fields on a block that will be viewed by a victim. The attack vector is passive for the victim, as the payload self-fires upon rendering in the autocomplete popup. This aligns with ATT&CK technique T1059 Command and Scripting Interpreter, specifically leveraging JavaScript within an Electron context to bypass traditional browser security boundaries. The lack of content isolation means that the web view effectively acts as a native application shell rather than a sandboxed browser tab, amplifying the severity of any script injection flaw present in its UI components.
Mitigation strategies must address both the immediate code defect and the broader architectural risks associated with Electron applications. Developers should immediately implement strict output encoding for all dynamic content inserted into HTML templates, ensuring that special characters such as angle brackets, quotes, and ampersands are properly escaped to prevent script injection. Additionally, it is critical to review the security configuration of Electron windows. Enabling contextIsolation and disabling nodeIntegration in renderer processes where Node.js APIs are not strictly necessary would significantly reduce the attack surface by preventing JavaScript from accessing system-level resources. Implementing a robust Content Security Policy further restricts the execution of inline scripts and limits resource loading sources, providing an additional layer of defense against script injection attacks. Until these patches are applied, users should exercise caution when interacting with documents containing block references created by untrusted parties.