CVE-2026-75916: SiYuan XSS-to-RCE via unescaped block metadata in hint popup
SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can set these metadata fields on a block can inject a self-firing payload (e.g. <img src=x onerror=...>) that executes automatically when a victim types '((' followed by a search term that surfaces the crafted block. Because SiYuan's Electron windows run with nodeIntegration enabled, contextIsolation disabled, and no CSP, the injected script gains require('childprocess') access, allowing the XSS to escalate to arbitrary OS command execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.7.3Patch SiYuan through 3.7.3 contains a cross-site scripting vulnerability
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must be able to set the name, alias, or memo metadata of a block. They must place a payload in that metadata and cause or wait for a victim to type "((" plus a search term that makes the crafted block appear in the autocomplete popup.
Does exploitation require the victim to click the malicious autocomplete result?
No. A self-firing payload embedded in the affected metadata can execute automatically when the crafted block is displayed in the block-reference autocomplete hint popup.
What is the impact after the script executes?
The injected script can access require('child_process') because the Electron windows have nodeIntegration enabled and contextIsolation disabled. This allows escalation from XSS to arbitrary operating-system command execution.
Which versions are affected?
SiYuan through version 3.7.3 is affected.