CyberRota Analysis
AI-GeneratedVersions of SiYuan prior to v3.7.4 are vulnerable due to inadequate validation of annotation fields, allowing attackers to inject malicious markup. This can lead to the execution of scripts with full Node.js access when a user opens an annotated PDF, posing a critical security risk. Organizations using affected versions should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.