CVE-2026-100645: SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban
SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, attackers can inject JavaScript that calls Node.js childprocess APIs to execute arbitrary commands with user privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.4
Event History
Frequently Asked Questions
Which environments are exposed to command execution?
The issue affects the SiYuan Electron desktop application when nodeIntegration is enabled. It is triggered through the gallery and kanban database renderers.
What must an attacker do to exploit this issue?
An attacker must inject JavaScript into a database field description that is later rendered in a gallery or kanban view. Exploitation also requires user interaction.
What is the impact if exploitation succeeds?
Injected JavaScript can call Node.js child_process APIs and execute arbitrary commands with the privileges of the affected user.
How can the issue be remediated?
Upgrade SiYuan to version 3.8.4 or later. The affected version range starts at 3.7.0 and ends before 3.8.4.