Executive Summary

This vulnerability exists in SiYuan, an open-source personal knowledge management system, in versions 3.6.3 and below. It involves the rendering of Mermaid diagrams with the securityLevel set to "loose". The resulting SVG is injected into the DOM using innerHTML, which allows attacker-controlled javascript: URLs within Mermaid code blocks to persist in the rendered output.

On desktop builds using Electron, windows are created with nodeIntegration enabled and contextIsolation disabled. This configuration escalates the stored cross-site scripting (XSS) vulnerability to arbitrary code execution when a victim opens a note containing a malicious Mermaid block and clicks the rendered diagram node.

This issue was fixed in version 3.6.4.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows an attacker to execute arbitrary code on the victim's machine. Specifically, when a user opens a note containing a malicious Mermaid diagram and interacts with it, the attacker-controlled javascript can run with elevated privileges due to Electron's nodeIntegration being enabled and contextIsolation disabled.

The consequences include complete compromise of the affected system, potentially leading to data theft, system manipulation, or further malware installation.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade SiYuan to version 3.6.4 or later, where the issue has been fixed.

Avoid opening notes containing Mermaid diagrams from untrusted sources, especially on desktop builds using Electron with nodeIntegration enabled and contextIsolation disabled.

Useful 0 Not Useful 0