CVE-2026-100641
Deferred Deferred - Pending Action

Stored XSS in SiYuan Flashcard Block Content

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content such as <img src=invalid onerror=...> becomes an executable event-handler attribute. Because the SiYuan desktop (Electron) main window is created with nodeIntegration enabled and contextIsolation disabled, an administrator who opens the card manager on a workspace containing attacker-supplied flashcard content (for example introduced through contribution or import) executes the attacker's script in a privileged renderer, which can lead to arbitrary code execution on the host. The affected endpoint remains behind authentication and administrator-role checks; this is an untrusted-content-to-privileged-renderer issue, not an authorization bypass.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100641
EUVD
EUVD-2026-87735

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
siyuan si_yuan to 3.8.4 (exc)
siyuan siyuan to 3.8.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan before v3.8.4 fails to escape HTML in flashcard block content. When this content is rendered in the card manager, malicious scripts can execute due to improper handling. The desktop app's Electron window has nodeIntegration enabled and contextIsolation disabled, allowing attacker-supplied scripts to run with elevated privileges.

Impact Analysis

An attacker with access to a workspace can inject malicious flashcard content. If an administrator opens the card manager, the script executes in a privileged context, potentially leading to full system compromise or arbitrary code execution on the host machine.

Compliance Impact

This vulnerability could lead to unauthorized access or data exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations using SiYuan may face compliance failures if attacker-controlled scripts access or manipulate sensitive data.

Mitigation Strategies

Upgrade SiYuan to version v3.8.4 or later to address the untrusted content rendering issue in the card manager.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100641. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart