CVE-2026-100645 siyuan-note CVE debrief

Who should care

Defenders responsible for SiYuan deployments, especially those using the Electron desktop app, should assess exposure and verify the feasibility of injecting JavaScript via gallery and kanban database renderers.

Why it matters

Defenders should prioritize verifying exposure in SiYuan deployments, especially those using the Electron desktop app with nodeIntegration enabled, and assess the feasibility of injecting JavaScript via gallery and kanban database renderers. This vulnerability could allow attackers to execute arbitrary commands with user privileges, potentially disrupting SiYuan services. Defenders must verify exposure, implement compensating controls, and plan for thorough inventory checks and remediation.

• Potential for attackers to execute arbitrary commands with user privileges
• Possible disruption of SiYuan services
• Need for defenders to verify exposure and implement compensating controls
• Requirement for thorough inventory checks and remediation planning

Technical summary

The vulnerability exists in SiYuan versions 3.7.0 before 3.8.4, where field descriptions in gallery and kanban database renderers are not properly escaped in aria-label attributes. This allows attackers to inject JavaScript that calls Node.js child_process APIs to execute arbitrary commands with user privileges in the Electron desktop app with nodeIntegration enabled. Defenders should prioritize verifying exposure in SiYuan deployments, especially those using the Electron desktop app with nodeIntegration enabled, and assess the feasibility of injecting JavaScript via gallery and kanban database renderers. The vulnerability could allow attackers to execute arbitrary commands with user privileges, potentially dis

Defensive priority

Defenders should prioritize verifying exposure in SiYuan deployments, especially those using the Electron desktop app with nodeIntegration enabled, and assess the feasibility of injecting JavaScript via gallery and kanban database renderers.

Recommended defensive actions

• Verify SiYuan version and assess exposure in gallery and kanban database renderers
• Review Electron desktop app configurations for nodeIntegration
• Implement input validation and output encoding for field descriptions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. Supplemental sources include a GitHub Security Advisory and a VulnCheck Advisory. Defenders should verify exposure in SiYuan deployments, especially those using the Electron desktop app with nodeIntegration enabled, and assess the feasibility of injecting JavaScript via gallery and kanban database renderers. This vulnerability could allow attackers to execute arbitrary commands with user privileges, potentially disrupting SiYuan. The

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.