SiYuan note-taking software versions before 3.8.4 contain a cross-site scripting (XSS) vulnerability due to improper HTML escaping of flashcard block content. This flaw allows attacker-supplied content to execute scripts in a privileged renderer context when an administrator views the card manager. The vulnerability requires authentication and administrator privileges to exploit and can lead to arbitrary code execution on the host system.
SiYuan note-taking software versions before 3.8.4 have an authorization omission vulnerability in the siyuan-get IPC handler. This flaw allows remote kernel renderers to access native clipboard data formats such as MathML, Office, and WPS bytes by invoking specific clipboard read commands. Attackers controlling remote renderer content can exploit this to obtain sensitive clipboard contents during user-mediated paste operations. The vulnerability is fixed in version 3.8.4.
SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts) from content pasted as plain-text Markdown containing a Kramdown inline attribute list (IAL). Because the shared Lute renderer parses Kramdown IAL from text/plain input, an attacker-supplied Markdown snippet using entity-encoded quotes in data-subtype breaks out of the attribute value when the gutter markup is re-parsed by the browser, injecting additional attributes such as autofocus and onfocus. If a victim pastes the crafted Markdown and the affected gutter control receives focus, the injected handler executes; in the Electron desktop application, where the main BrowserWindow enables Node integration and disables context isolation, this results in JavaScript execution with renderer Node.js privileges (remote code execution). Fixed in v3.8.4.
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitrary directory trees and write files outside the workspace boundary. Attackers can supply directory traversal sequences in the notebook parameter to escape the workspace data directory and write conf.json files to arbitrary locations accessible by the kernel process.
SiYuan versions before 3.8.4 have a path traversal vulnerability in the checkoutRepo endpoint. Authenticated administrators can exploit this flaw by supplying a crafted sessionID parameter to write JSON files outside the intended workspace directory. This allows overwriting arbitrary JSON files in kernel-writable directories beyond workspace boundaries.
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can supply a folder parameter with directory traversal sequences to escape the export directory and overwrite index.html in any pre-existing kernel-writable location, enabling stored XSS or workspace defacement.
SiYuan versions prior to 3.8.4 have an authentication bypass vulnerability in the publish service. Session cookies are transmitted without Secure or SameSite attributes over plaintext HTTP, allowing an attacker on the network path to capture and replay a valid session cookie to access authenticated publish endpoints without the account password. This issue is fixed in version 3.8.4.
SiYuan note-taking software versions before 3.8.4 contain a missing authorization vulnerability in the 'siyuan-send-windows' IPC handler within the Electron main process. This flaw allows a renderer connected to a remote kernel to send commands that cause windows from other workspaces to lock repeatedly, resulting in a limited denial of service. There is no observed impact on confidentiality, integrity, or code execution.
SiYuan versions 3.8.0 through 3.8.3 contain an authorization bypass vulnerability in the MCP file tool's sensitive-path guard. The guard is applied only to the root of recursive operations but not to each descendant path, allowing an authenticated administrator to bypass protections on sensitive files and directories. This enables actions such as reading, copying, and overwriting protected files without proper confirmation. The issue is fixed in version 3.8.4.
SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGraph endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across notebooks.
SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to child_process for command execution.
SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to child_process for command execution.
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory.
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYuan origin when victims preview the assets, enabling authenticated API requests and workspace manipulation.
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's browser when searching assets, enabling same-origin API requests and application state manipulation.
SiYuan note-taking software versions prior to 3.8.2 contain a stored cross-site scripting (XSS) vulnerability. This flaw occurs because the iconURL metadata in Bazaar package cards is inserted directly into HTML img src attributes without proper escaping. An attacker can exploit this by injecting malicious URLs with event handlers that execute JavaScript when authenticated users view Bazaar listings. This enables unauthorized API requests and manipulation of application state within the authenticated session.
SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft malicious template paths that break out of the attribute context and execute JavaScript when a victim opens notebook configuration, enabling same-origin API requests and application state manipulation.
Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching content exists in hidden or unpublished documents and determine the number of matching blocks and pages.
Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. Attackers with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing public documents containing embed queries that select those blocks.
SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh-x834-p3r7). The prior fix (commit d5e2d0bc) added an administrator check for SQL mode (method=2) in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for method=2 it forwards caller-supplied SQL to the blocks database query path without calling model.CheckReadonly or CheckReadonlyStatementInBox. As a result, when a workspace runs in read-only mode (--readonly=true), an authenticated administrator can submit arbitrary SQL through /api/search/fullTextSearchBlock and obtain raw read access to the blocks database, even though the dedicated /api/query/sql endpoint is blocked in that mode. Fixed in v3.8.2.