Executive Summary

This vulnerability exists in SiYuan, an open-source personal knowledge management system, prior to version 3.7.0. The kernel HTTP server in SiYuan Note unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication.

Because the default AccessAuthCode is empty on desktop installs, any Chrome or Chromium extension—including a compromised legitimate extension via a supply chain attack—can make fully authenticated admin API calls to the SiYuan kernel at 127.0.0.1:6806.

This allows attackers to perform actions such as data exfiltration, stored cross-site scripting (XSS) injection, and configuration tampering.

The vulnerability was fixed in version 3.7.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized administrative access to the SiYuan kernel via any installed Chrome or Chromium extension.

An attacker could exfiltrate sensitive data stored in SiYuan, inject malicious scripts through stored XSS attacks, and tamper with the application's configuration.

Such actions could compromise the confidentiality, integrity, and availability of your data and system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade SiYuan Note to version 3.7.0 or later, where the issue is fixed.

Additionally, avoid running untrusted Chrome/Chromium extensions, as any installed extension can gain administrator access due to the vulnerability.

Consider configuring AccessAuthCode to a non-empty value to prevent unauthenticated access.

Useful 0 Not Useful 0