CVE-2026-75917
Received Received - Intake

SiYuan XSS to RCE via Unescaped Metadata in File-Tree Picker

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts, getLeaf()/movePathTo()) used by the 'move/link to' path-selection dialogs, where document metadata fields (bookmark, alias, memo, and an alternate name field) are concatenated into the aria-label HTML attribute without escaping. A document crafted with a double quote in any of these fields breaks out of the attribute context and injects arbitrary HTML attributes including inline event handlers (e.g., onmouseover). Because every SiYuan Electron BrowserWindow runs with nodeIntegration:true, contextIsolation:false, and no CSP, the injected handler gains require('child_process') access, escalating the XSS to arbitrary OS command execution when a victim merely hovers over the malicious document entry in the path-picker dialog. Malicious documents reach victims via sharing, sync, or import.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-75917
EUVD
EUVD-2026-62442

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
si_yuan si_yuan to 3.7.4 (exc)
siyuan siyuan to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in SiYuan before v3.7.4 that allows remote code execution (RCE). It occurs in the file-tree picker's hover-tooltip generation where document metadata fields (bookmark, alias, memo, alternate name) are concatenated into an HTML aria-label attribute without escaping. An attacker can inject malicious HTML attributes like onmouseover by including a double quote in these fields. When a victim hovers over the malicious entry, the injected handler executes arbitrary OS commands due to SiYuan's Electron configuration with nodeIntegration:true and contextIsolation:false.

Detection Guidance

Detecting this vulnerability requires checking the SiYuan version and inspecting document metadata fields for crafted content. Look for documents with double quotes or unusual characters in bookmark, alias, memo, or alternate name fields. Check SiYuan's Electron configuration files for nodeIntegration:true and contextIsolation:false settings.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system with the same privileges as the SiYuan application. Simply hovering over a malicious document entry in the file-tree picker can trigger the attack. The payload can spread through shared documents, sync, or import mechanisms, potentially compromising your system without requiring additional user interaction beyond normal application use.

Compliance Impact

This vulnerability could lead to severe compliance violations under GDPR and HIPAA due to potential unauthorized data access, modification, or exfiltration. GDPR requires protection against unauthorized processing, while HIPAA mandates safeguards for protected health information. The RCE capability could result in data breaches, unauthorized system access, or data integrity violations, triggering mandatory breach notifications and significant penalties.

Mitigation Strategies

Immediately upgrade SiYuan to version 3.7.4 or later. Disable nodeIntegration and enable contextIsolation in SiYuan's Electron configuration. Implement strict input validation for document metadata fields. Avoid opening path-picker dialogs on untrusted notebooks until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75917. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart