SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

Attack Vector

1. Attacker creates a malicious note containing an Attribute View (database).
2. Attacker adds an asset cell with link content: <img src=x onerror=require('child_process').exec('calc')>
3. Victim opens the note for immediate RCE (Sink 1), or hovers over the cell for RCE (Sink 2).
4. In a sync/collaboration scenario, the malicious note propagates to all users.

Proof of Concept

Payload (Direct XSS) — in an AV asset cell link field, enter:

  <img src=x onerror=alert(document.domain)>

For RCE in Electron desktop:

  <img src=x onerror=require('child_process').exec('calc')>

Steps to Reproduce

1. Open SiYuan desktop app (v3.6.5).
2. Create a new document.
3. Insert an Attribute View (database): / then select "Table".
4. Add a column of type "Asset".
5. Click the asset cell, then "Add Link".
6. In the "Link" textarea, paste: <img src=x onerror=alert(1)>
7. Leave "Title" empty or fill with benign text.
8. Click outside the dialog to save.
9. Observe: Alert fires immediately (Sink 1). Hovering over the cell also triggers (Sink 2).

Impact

• Remote Code Execution on victim's system via malicious note sync/import.
• Data exfiltration: attacker can read all notes, access filesystem, steal credentials.
• Persistence: malicious payload stored in .sy files, executes on every open.

Suggested Fix

1. Replace escapeAttr() with escapeAriaLabel() for all aria-label attributes in AV cell renderers.
2. Escape item.name and item.content with escapeHtml() before concatenating into element text content.

Affected files: app/src/protyle/render/av/cell.ts, app/src/protyle/render/av/blockAttr.ts, app/src/protyle/render/av/asset.ts.

Additional Context

This vulnerability is a neighbor-bug of CVE-2026-44588. The fix for -44588 correctly used escapeAriaLabel() (which double-escapes < to survive the attribute -> getAttribute -> innerHTML round-trip), but the AV asset cell renderers were left using the weaker escapeAttr() or no escaping. This is part of a pattern of incomplete fixes in SiYuan (see also CVE-2026-33066, CVE-2026-29183). The long-term fix should set ElectroncontextIsolation: true and nodeIntegration: false.

Report

Reporter (GitHub: Yunkaiwjs).