Critical Cross-Site Scripting Vulnerability in SiYuan Note-taking App

Executive Summary

A critical cross-site scripting (XSS) vulnerability, CVE-2026-74902, with a CVSS score of 8.6, has been identified in SiYuan, a note-taking application. This vulnerability affects versions prior to 3.7.4 and allows attackers to execute malicious scripts with full OS command access. The vulnerability is triggered when a user drags, drops, or pastes a file with a malicious filename into the editor.

Technical Analysis

The vulnerability class is cross-site scripting (XSS). The attack vector involves an attacker crafting a malicious filename containing script payloads. When a user interacts with the file (by dragging, dropping, or pasting it into the editor), the script executes with full OS command access. The root cause is the application's failure to escape filenames before inserting them into HTML via `insertAdjacentHTML`.

How It Gets Exploited

An attacker would need to craft a malicious filename containing a script payload. When a user with access to the SiYuan application drags, drops, or pastes the file into the editor, the script in the filename is executed. This execution occurs in the context of the user's session, potentially allowing the attacker to achieve arbitrary code execution as the web service user.

Impact Assessment

The vulnerability affects SiYuan versions prior to 3.7.4. Successful exploitation can lead to arbitrary code execution, data exfiltration, and other malicious activities. The CVSS score of 8.6 indicates a high severity level. The vulnerability has not been reported as actively exploited.

Recommended Actions

To mitigate this vulnerability, update SiYuan to version 3.7.4 or later immediately. Additionally, users should exercise caution when interacting with files from untrusted sources. Implement network segmentation or restrict access to the SiYuan application to limit the potential impact.

Sources

- National Vulnerability Database (NVD) - Vulncheck - GitHub Security Advisory