CVE-2026-75917 Overview
CVE-2026-75917 is a cross-site scripting (XSS) vulnerability in SiYuan, a personal knowledge management application, affecting versions prior to v3.7.4. The flaw resides in the file-tree picker's hover-tooltip generation within app/src/util/pathName.ts, specifically the getLeaf() and movePathTo() functions. Document metadata fields including bookmark, alias, memo, and an alternate name field are concatenated into the aria-label HTML attribute without escaping. Because SiYuan's Electron BrowserWindow runs with nodeIntegration:true, contextIsolation:false, and no Content Security Policy, the XSS escalates to arbitrary operating system command execution. The issue is tracked as [CWE-79].
Critical Impact
A victim who merely hovers over a malicious document entry in the move/link path-picker dialog triggers arbitrary OS command execution via require('child_process').
Affected Products
- SiYuan versions before v3.7.4
- SiYuan Electron desktop application
- All platforms running the vulnerable SiYuan client (Windows, macOS, Linux)
Discovery Timeline
- 2026-08-19 - CVE-2026-75917 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-75917
Vulnerability Analysis
The vulnerability is triggered when a user opens the move/link path-selection dialog in SiYuan. The getLeaf() and movePathTo() functions in app/src/util/pathName.ts build tooltip markup by concatenating document metadata directly into an aria-label HTML attribute. None of the metadata fields are HTML-encoded before insertion, so a document containing a double-quote character in its bookmark, alias, memo, or alternate name field can terminate the attribute early. Once outside the attribute context, an attacker can inject arbitrary HTML attributes, including inline event handlers such as onmouseover.
Root Cause
The root cause is missing output encoding of user-controlled metadata before insertion into an HTML attribute. Combined with the Electron runtime configuration of nodeIntegration:true, contextIsolation:false, and no Content Security Policy, any injected JavaScript executes in a fully privileged renderer context. The renderer has direct access to Node.js APIs, including require('child_process'), which allows spawning arbitrary operating system commands.
Attack Vector
An attacker crafts a SiYuan document with a payload embedded in one of the affected metadata fields. Delivery vectors include shared notebooks, cloud sync, or document import. When the victim opens the file-tree picker and hovers over the malicious entry, the injected event handler fires and executes attacker-controlled code with the privileges of the SiYuan process. No further user interaction beyond the hover is required after the malicious document is present in the workspace.
No verified proof-of-concept code is publicly available. See the GitHub Security Advisory and the VulnCheck Advisory for additional technical detail.
Detection Methods for CVE-2026-75917
Indicators of Compromise
- SiYuan documents whose bookmark, alias, memo, or alternate name metadata fields contain double-quote characters followed by HTML event handler attributes such as onmouseover=, onerror=, or onfocus=.
- Child processes spawned by the SiYuan Electron process (for example cmd.exe, powershell.exe, /bin/sh) with no legitimate user action correlating to a note-editing operation.
- Unexpected outbound network connections initiated by the SiYuan process shortly after opening the move/link path-selection dialog.
Detection Strategies
- Scan SiYuan workspace directories for .sy document files containing suspicious substrings in metadata fields, such as " onmouseover= or "><script.
- Alert on the SiYuan binary spawning shell interpreters or scripting engines, which is not part of its normal runtime behavior.
- Inspect sync and import logs for documents originating from untrusted sources that were added prior to a suspicious process event.
Monitoring Recommendations
- Enable endpoint process-tree telemetry for the SiYuan process to capture parent-child relationships during document interactions.
- Monitor file writes to SiYuan workspace paths from network sync clients and correlate against user-initiated activity.
- Track version inventory for SiYuan installations across managed endpoints to identify hosts still running builds prior to v3.7.4.
How to Mitigate CVE-2026-75917
Immediate Actions Required
- Upgrade all SiYuan installations to v3.7.4 or later, which contains the fix for the unescaped aria-label concatenation.
- Audit shared notebooks, sync targets, and recently imported documents for metadata payloads containing double quotes or HTML event handlers.
- Restrict document sharing and sync to trusted sources until all clients in a workspace are patched.
Patch Information
The vendor released a fixed build in SiYuan v3.7.4. The patch escapes document metadata fields before concatenation into the aria-label attribute in app/src/util/pathName.ts. Refer to the GitHub Security Advisory GHSA-jjq3-3942-x99r for the authoritative fix reference.
Workarounds
- Avoid opening the move/link path-selection dialog until the client is upgraded, since the injected handler fires on hover within that dialog.
- Do not import or sync SiYuan documents from untrusted parties on unpatched clients.
- Where feasible, isolate the SiYuan Electron process using operating system sandboxing or application allowlisting to limit the impact of child_process execution.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
