GHSA-56mp-4f3v-fgj2 SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

• Go github.com/siyuan-note/siyuan/kernel: < 0.0.0-20260628153353-2d5d72223df4 → fixed in 0.0.0-20260628153353-2d5d72223df4

SiYuan v3.6.5 and earlier versions contain a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This is a neighbor-bug of CVE-2026-44588: the fix for -44588 used `escapeAriaLabel()` (double-escapes `${item.name || item.content}`; The `>${item.name || item.content}` portion is raw user input with zero escaping. `app/src/protyle/render/av/blockAttr.ts:93` (even worse - completely unescaped): html += ``; Rendered via `action.ts:860`: `cellElement.innerHTML = renderCell(...)` results in immediate XSS on page load. ### Sink 2 (Hover-triggered XSS via aria-label round-trip) • Same lines emit `aria-label="${escapeAttr(item.content)}"` on `.ariaLabel` elements. • `escapeAttr()` (util/escape.ts:14) escapes only `"` and `'` — NOT ``. • `popover.ts:33` global mouseover handler reads `aria-label` via `getAttribute` (which attribute-decodes entities). • Line 144: `showTooltip(decodeURIComponent(tip), ...)` then `tooltip.ts:41`: `messageElement.innerHTML = message` results in XSS on hover. ### Source • `app/src/protyle/render/av/asset.ts:405`: `addAssetLink()` reads user input from a free-form `` with no sanitization. • Kernel stores `MAsset.Content` raw (kernel/av/value.go:53), no server-side sanitization. ## Attack Vector 1. Attacker creates a malicious note containing an Attribute View (database). 2. Attacker adds an asset cell with link content: `` 3. Victim opens the note for immediate RCE (Sink 1), or hovers over the cell for RCE (Sink 2). 4. In a sync/collaboration scenario, the malicious note propagates to all users. ## Proof of Concept Payload (Direct XSS) — in an AV asset cell link field, enter: For RCE in Electron desktop: ### Steps to Reproduce 1. Open SiYuan desktop app (v3.6.5). 2. Create a new document. 3. Insert an Attribute View (database): `/` then select "Table". 4. Add a column of type "Asset". 5. Click the asset cell, then "Add Link". 6. In the "Link" textarea, paste: `` 7. Leave "Title" empty or fill with benign text. 8. Click outside the dialog to save. 9. Observe: Alert fires immediately (Sink 1). Hovering over the cell also triggers (Sink 2). ## Impact • Remote Code Execution on victim's system via malicious note sync/import. • Data exfiltration: attacker can read all notes, access filesystem, steal credentials. • Persistence: malicious payload stored in `.sy` files, executes on every open. ## Suggested Fix 1. Replace `escapeAttr()` with `escapeAriaLabel()` for all `aria-label` attributes in AV cell renderers. 2. Escape `item.name` and `item.content` with `escapeHtml()` before concatenating into element text content. Affected files: `app/src/protyle/render/av/cell.ts`, `app/src/protyle/render/av/blockAttr.ts`, `app/src/protyle/render/av/asset.ts`. ## Additional Context This vulnerability is a neighbor-bug of CVE-2026-44588. The fix for -44588 correctly used `escapeAriaLabel()` (which double-escapes ` `getAttribute` -> `innerHTML` round-trip), but the AV asset cell renderers were left using the weaker `escapeAttr()` or no escaping. This is part of a pattern of incomplete fixes in SiYuan (see also CVE-2026-33066, CVE-2026-29183). The long-term fix should set Electron`contextIsolation: true` and `nodeIntegration: false`. ## Report Reporter (GitHub: Yunkaiwjs).