CyberRota Analysis
AI-GeneratedSiYuan versions prior to 3.7.4 are vulnerable to a critical security flaw that allows attackers to inject malicious scripts through improperly escaped database menu metadata. This vulnerability can lead to the execution of arbitrary code when users interact with group, view, or field-edit menus, potentially compromising sensitive data and system integrity. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitrary code via event handlers, reaching Node built-ins due to Electron's insecure configuration.