CyberRota Analysis
AI-GeneratedSiYuan versions prior to 3.8.2 are vulnerable due to improper encoding of HTML input value attributes, allowing attackers to inject malicious template paths. This can lead to JavaScript execution when a user accesses notebook configurations, potentially enabling unauthorized API requests and manipulation of application state. Organizations using affected versions of SiYuan should prioritize patching to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft malicious template paths that break out of the attribute context and execute JavaScript when a victim opens notebook configuration, enabling same-origin API requests and application state manipulation.