SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE

The primary impact of CVE-2026-40322 stems from the ability to inject attacker-controlled JavaScript into the SiYuan application. Because the desktop builds utilize Electron with nodeIntegration enabled and contextIsolation disabled, a successful XSS attack can escalate to arbitrary code execution. An attacker could potentially steal sensitive data stored within the SiYuan knowledge base, modify notes, or even gain control of the user's system. The blast radius is significant, particularly for users relying on SiYuan for sensitive information or those sharing notes containing malicious diagrams. This vulnerability shares similarities with other Electron-based XSS exploits where improper context isolation allows for broader code execution.

1. Reserviert2026-04-10
2. Veröffentlicht2026-04-16
3. Geändert2026-04-17
4. EPSS aktualisiert2026-04-24

The primary mitigation for CVE-2026-40322 is to immediately upgrade SiYuan to version 3.6.4 or later. If upgrading is not immediately feasible, consider disabling Mermaid diagram rendering as a temporary workaround. While not a complete solution, this will prevent the injection of malicious code. For environments where SiYuan is integrated with other systems, review and validate all incoming Mermaid diagrams to ensure they do not contain malicious content. There are no specific WAF rules or detection signatures readily available, but monitoring for unusual JavaScript execution within the Electron process is recommended.