CVE-2026-100641: SiYuan Flashcard XSS to RCE Vulnerability

CVE-2026-100641 is a stored XSS vulnerability in SiYuan that escalates to remote code execution through Electron's privileged context. Attackers can inject malicious flashcard content to execute arbitrary code. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-100641 Overview

CVE-2026-100641 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in SiYuan, a personal knowledge management application. Versions before v3.8.4 fail to HTML-escape flashcard block content before inserting it into the card manager interface. The affected code path in app/src/card/viewCards.ts assigns untrusted content directly to listElement.innerHTML, enabling event-handler attribute injection. Because the SiYuan desktop Electron main window runs with nodeIntegration enabled and contextIsolation disabled, injected JavaScript executes in a privileged renderer. This can escalate to arbitrary code execution on the host operating system when an administrator opens the card manager.

Critical Impact
An authenticated administrator opening a workspace with attacker-supplied flashcard content triggers script execution in a Node-integrated renderer, resulting in arbitrary code execution on the host.

Affected Products

SiYuan desktop (Electron) versions before v3.8.4
SiYuan workspaces containing attacker-contributed or imported flashcard data
Deployments exposing the /api/riff/getRiffCards endpoint to multiple contributors

Discovery Timeline

2026-09-26 - CVE-2026-100641 published to NVD
2026-09-26 - Last updated in NVD database

Technical Details for CVE-2026-100641

Vulnerability Analysis

The vulnerability resides in SiYuan's flashcard management interface. When an administrator opens the card manager, the client calls /api/riff/getRiffCards to retrieve stored flashcard blocks. The returned block content is interpolated into a card item HTML template and assigned to listElement.innerHTML without HTML-escaping. Content such as <img src=invalid onerror=...> becomes an executable event handler attribute. The endpoint itself remains protected by authentication and administrator-role checks, so this is an untrusted-content-to-privileged-renderer flaw rather than an authorization bypass.

The impact is amplified by SiYuan's Electron configuration. The desktop main window is created with nodeIntegration enabled and contextIsolation disabled. Any JavaScript executing in the renderer therefore has direct access to Node.js APIs such as require('child_process'), allowing arbitrary command execution on the host system.

Root Cause

The root cause is missing output encoding when rendering user-controlled block content into an HTML sink. The client code trusts stored flashcard content and uses innerHTML assignment instead of textContent or an escaping helper. The absence of Electron hardening (contextIsolation: true, nodeIntegration: false) converts a client-side DOM XSS into a host compromise primitive.

Attack Vector

An attacker introduces malicious flashcard block content into a shared SiYuan workspace through contribution workflows, document import, or any other path that writes blocks persisted by the Riff flashcard subsystem. When an administrator subsequently opens the card manager, the stored payload is fetched and inserted into the DOM. The event handler fires, Node integration is available, and the payload executes code on the administrator's machine.

typescript

// Patch excerpt from app/src/card/viewCards.ts (commit 41b14025)
                 updateReadonly: true,
                 data: getResponse,
                 protyle: edit.protyle,
-                action: getResponse.data.rootID === getResponse.data.id ? [Constants.CB_GET_HTML] : [Constants.CB_GET_ALL, Constants.CB_GET_HTML],
-                afterCB() {
-                    edit.protyle.title.element.removeAttribute("data-render");
-                    edit.protyle.title.render(edit.protyle, response);
-                }
+                action: getResponse.data.rootID === getResponse.data.id ? [] : [Constants.CB_GET_ALL],
             });
         });
     });

Source: GitHub Commit 41b14025. The fix removes the CB_GET_HTML render action path that reinjected unsanitized block HTML into the preview, closing the renderer-side execution sink.

Detection Methods for CVE-2026-100641

Indicators of Compromise

Flashcard block content containing HTML tags with event handler attributes such as onerror, onload, or onclick.
Unexpected child processes spawned by the SiYuan Electron process (siyuan.exe, SiYuan.app) shortly after a card manager session.
Outbound network connections from the SiYuan renderer to unknown hosts after opening the flashcard view.

Detection Strategies

Scan stored block content in SiYuan workspaces for suspicious HTML fragments and <script> or event-handler attributes.
Monitor Electron process trees for child processes invoking shells, PowerShell, cmd.exe, or node subprocesses from a note-taking application.
Review access logs for /api/riff/getRiffCards and correlate with administrator sessions on shared workspaces.

Monitoring Recommendations

Alert on process-creation events where the parent image is the SiYuan Electron binary and the child is a scripting interpreter.
Capture file-write and persistence events (startup folders, scheduled tasks, cron) originating from the SiYuan process.
Baseline normal network behavior for the SiYuan host and alert on anomalous egress destinations.

How to Mitigate CVE-2026-100641

Immediate Actions Required

Upgrade SiYuan to v3.8.4 or later on all desktop installations.
Restrict administrator access to shared workspaces until the upgrade is deployed.
Audit existing flashcard content in multi-contributor workspaces for HTML payloads before next administrator use.

Patch Information

The fix is distributed across upstream commits 1ecb1c0, 41b1402, 48c354e, and 8641553. Full details are available in the GitHub Security Advisory GHSA-2mmf-4xwm-55rm and the VulnCheck advisory.

Workarounds

Avoid opening the card manager on workspaces containing content from untrusted contributors until patched.
Disable or restrict the flashcard subsystem by limiting Riff API access at the reverse proxy layer.
Operate SiYuan in a sandboxed account or virtual machine to limit blast radius if the renderer is compromised.

bash

# Verify installed SiYuan version meets the fixed release
siyuan --version
# Expected output: 3.8.4 or newer