SiYuan: 属性视图画廊/看板封面渲染中的存储型 XSS 允许在桌面客户端中执行任意命令

该 XSS 漏洞允许攻击者在受害者的 Siyuan Note 客户端中执行任意 JavaScript 代码。由于 Electron 桌面客户端启用了 nodeIntegration 且禁用了 contextIsolation，攻击者可以利用此漏洞执行操作系统命令，从而完全控制受害者的系统。攻击者可以窃取敏感数据，安装恶意软件，或进行其他恶意活动。该漏洞的严重程度极高，可能导致严重的系统安全事件。

Users of Siyuan who utilize the Gallery or Kanban views with “Cover From -> Asset Field” enabled are at significant risk. This includes users who rely on Siyuan for sensitive note-taking or collaboration, as the vulnerability could lead to data theft or system compromise. Organizations using Siyuan in shared hosting environments are particularly vulnerable, as a compromised account could potentially impact other users on the same server.

• windows / supply-chain:

Get-WinEvent -LogName Application -Filter "EventID=1000 -Message contains 'siyuan'"

• linux / server:

journalctl -u siyuan | grep -i 'error' -i 'warning'

• wordpress / composer / npm: N/A • database (mysql, redis, mongodb, postgresql): N/A • generic web: N/A

1. 2026-03-31Disclosure

   disclosure

1. 已保留2026-03-27
2. 发布日期2026-03-31
3. 修改日期2026-04-06
4. EPSS 更新日期2026-04-08

最有效的缓解措施是立即升级到 Siyuan Note 3.6.2 或更高版本。如果无法立即升级，可以尝试禁用“封面来自 -> 资产字段”功能，但这会影响 Siyuan Note 的正常使用。此外，建议对 Siyuan Note 的安装目录进行安全审计，检查是否存在可疑文件或脚本。监控 Siyuan Note 的日志文件，查找异常活动。