CyberRota Analysis
AI-GeneratedSiYuan versions prior to 3.8.4 are vulnerable due to improper HTML escaping of stored flashcard block content, allowing attackers to inject executable scripts via the card-manager list markup. This vulnerability can lead to arbitrary code execution on the host system when an administrator interacts with compromised flashcard content, particularly in environments with nodeIntegration enabled and contextIsolation disabled. Organizations using SiYuan should prioritize patching this vulnerability to mitigate the risk of remote code execution in their applications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content such as <img src=invalid onerror=...> becomes an executable event-handler attribute. Because the SiYuan desktop (Electron) main window is created with nodeIntegration enabled and contextIsolation disabled, an administrator who opens the card manager on a workspace containing attacker-supplied flashcard content (for example introduced through contribution or import) executes the attacker's script in a privileged renderer, which can lead to arbitrary code execution on the host. The affected endpoint remains behind authentication and administrator-role checks; this is an untrusted-content-to-privileged-renderer issue, not an authorization bypass.