A stored cross-site scripting vulnerability in SiYuan allows authenticated attackers to execute arbitrary scripts in the browsers of other users who view compromised documents.

The application fails to properly escape input in block names, aliases, and memo fields, which are processed during hint, backlink, and breadcrumb rendering. This flaw allows a low privileged, authenticated user to inject malicious HTML or script tags that trigger execution when other users view the affected content.

Successful exploitation allows an attacker to compromise user sessions, steal sensitive session tokens, or perform unauthorized actions on behalf of other users. With a CVSS score of 8.9, this vulnerability represents a high risk to data integrity and confidentiality, potentially leading to unauthorized access to private notes or account takeover within the application environment.

Immediate Action: Upgrade to SiYuan version 3.8.1 or later, which includes the necessary security patches to sanitize user inputs.

Proactive Monitoring: Review application access logs for unusual patterns in block name updates or unexpected script-like characters being injected into metadata fields.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block common cross-site scripting payloads.

Public Exploit Available: No.

The severity of this vulnerability is significant due to the potential for lateral movement and account compromise through malicious script execution. Organizations using SiYuan must prioritize upgrading to version 3.8.1 to eliminate the risk of stored cross-site scripting. Delaying this update exposes all users to potential session hijacking and unauthorized data access.