CVE-2026-75917: SiYuan before v3.7.4 XSS-to-RCE via pathName.ts
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts, getLeaf()/movePathTo()) used by the 'move/link to' path-selection dialogs, where document metadata fields (bookmark, alias, memo, and an alternate name field) are concatenated into the aria-label HTML attribute without escaping. A document crafted with a double quote in any of these fields breaks out of the attribute context and injects arbitrary HTML attributes including inline event handlers (e.g., onmouseover). Because every SiYuan Electron BrowserWindow runs with nodeIntegration:true, contextIsolation:false, and no CSP, the injected handler gains require('childprocess') access, escalating the XSS to arbitrary OS command execution when a victim merely hovers over the malicious document entry in the path-picker dialog. Malicious documents reach victims via sharing, sync, or import.
Affected Software
Event History
Frequently Asked Questions
Which users are exposed to exploitation?
Users are exposed when they open a “move/link to” path-selection dialog containing a malicious document and hover over that document’s entry. Malicious documents can arrive through sharing, synchronization, or import.
What must an attacker do to trigger command execution?
An attacker must craft a document whose bookmark, alias, memo, or alternate name field contains a double quote that escapes the tooltip aria-label attribute and injects an inline event handler. The victim must then hover over the malicious document in the path-picker dialog.
Is this limited to a non-default Electron configuration?
No. The vulnerable Electron BrowserWindows are described as running with nodeIntegration enabled, contextIsolation disabled, and no CSP. These conditions allow the injected JavaScript to access child_process and execute operating-system commands.
How can exposure be reduced before updating?
Avoid importing, syncing, or opening untrusted shared documents, particularly in “move/link to” dialogs. Do not hover over suspicious document entries in those dialogs until the installation is updated.
How can I determine whether an installation is affected?
SiYuan versions before v3.7.4 are affected. Documents with double quotes in bookmark, alias, memo, or alternate name metadata may be capable of triggering the issue when displayed in the affected path-picker tooltip.