CVE-2026-59855

Description

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/src/asset/index.ts interpolates the unsanitized this.path value into HTML assigned to innerHTML, allowing a crafted asset link containing a double quote to break out of the src attribute, inject an event handler, and execute JavaScript that can run OS commands in the Electron renderer. This issue is fixed in versions 3.7.1-alpha.2 and 3.7.1.

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w3gq-5j72-36vc

https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1

https://github.com/siyuan-note/siyuan/commit/efbe3a557720034782643e55c9e0282530cb6bbb

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4