Home

Description

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/src/asset/index.ts interpolates the unsanitized this.path value into HTML assigned to innerHTML, allowing a crafted asset link containing a double quote to break out of the src attribute, inject an event handler, and execute JavaScript that can run OS commands in the Electron renderer. This issue is fixed in versions 3.7.1-alpha.2 and 3.7.1.

PUBLISHED Reserved 2026-07-07 | Published 2026-07-09 | Updated 2026-07-14 | Assigner GitHub_M




HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Product status

< 3.7.1
affected

References

github.com/...siyuan/security/advisories/GHSA-w3gq-5j72-36vc exploit

github.com/...siyuan/security/advisories/GHSA-w3gq-5j72-36vc

github.com/...ommit/efbe3a557720034782643e55c9e0282530cb6bbb

github.com/siyuan-note/siyuan/releases/tag/v3.7.1

cve.org (CVE-2026-59855)

nvd.nist.gov (CVE-2026-59855)

Download JSON