CVE-2026-100641: SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content
SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content such as <img src=invalid onerror=...> becomes an executable event-handler attribute. Because the SiYuan desktop (Electron) main window is created with nodeIntegration enabled and contextIsolation disabled, an administrator who opens the card manager on a workspace containing attacker-supplied flashcard content (for example introduced through contribution or import) executes the attacker's script in a privileged renderer, which can lead to arbitrary code execution on the host. The affected endpoint remains behind authentication and administrator-role checks; this is an untrusted-content-to-privileged-renderer issue, not an authorization bypass.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.4
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Administrators using the SiYuan desktop application are exposed when they open the card manager for a workspace that contains attacker-supplied flashcard content. Content may be introduced through sources such as contributions or imports.
What does an attacker need to do to exploit it?
The attacker needs to get crafted content into a stored flashcard block and convince an administrator to open the card manager. The vulnerable card-list rendering then inserts the content as HTML, allowing event-handler attributes to execute.
Is this an authentication or authorization bypass?
No. The affected /api/riff/getRiffCards endpoint remains protected by authentication and administrator-role checks; the issue is execution of untrusted stored content in a privileged renderer after an authorized administrator views it.
What can be done before updating?
Avoid opening the card manager for workspaces containing untrusted flashcard content, including content received through contributions or imports. Review such content before it is made available to administrators.
How can an organization assess whether it may be affected?
Check whether it runs a SiYuan version earlier than v3.8.4 and whether administrators use the card manager on workspaces that accept imported or contributor-supplied flashcard blocks. Crafted HTML such as an image element with an event-handler attribute is an indicator of malicious content.