CVE-2026-34448

EUVD-2026-17675 · Published Mar 31, 2026

SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client

Summary

An attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From -> Asset Field” enabled. The vulnerable code accepts arbitrary http(s) URLs without extensions as images, stores the attacker-controlled string in coverURL, and injects it directly into an <img src="..."> attribute without escaping. In the Electron desktop client, the injected JavaScript executes with nodeIntegration enabled and contextIsolation disabled, so the XSS reaches arbitrary OS command execution under the victim’s account.

Details

The vulnerable flow is:

IsPossiblyImage(assetPath) accepts arbitrary http(s) URLs without validating that they are safe image URLs.
When an Attribute View card uses Cover From -> Asset Field, the application copies asset.Content directly into galleryCard.CoverURL / kanbanCard.CoverURL.
The front-end renderer inserts coverURL directly into <img src="${getCompressURL(item.coverURL)}"> without escaping quotes or other attribute-breaking characters.
A payload such as https://example.com/" onerror="require('child_process').exec('calc') breaks out of the src attribute and adds an attacker-controlled onerror handler.
When the image fails to load, the injected JavaScript runs in the Electron renderer. Because the desktop app enables nodeIntegration: true and disables contextIsolation and webSecurity, that JavaScript can access Node.js APIs and execute system commands.

PoC

Install Electron Desktop app.
Create a database / Attribute View with an mAsset column and add at least one row.
Add any legitimate image to that mAsset field so the entry is stored as type image.
Switch the view to Gallery or Kanban.
5.Set Cover From to Asset Field and choose the mAsset column.
Edit the existing image asset entry and replace its link with the following payload:

https://example.com/" onerror="require('child_process').exec('calc')

Save the change and reopen or refresh the Gallery / Kanban view.
Observe that the rendered HTML contains an injected onerror handler and the Calculator application starts on Windows.

Example rendered output:

<img loading="lazy" class="av__gallery-img" src="https://example.com/" onerror="require('child_process').exec('calc')">

Impact

An attacker can store malicious content in a database asset field and execute arbitrary JavaScript when another user opens the affected Gallery or Kanban view. In the desktop client, that JavaScript has access to Node.js APIs, so the impact is not limited to browser-context XSS. The payload executes OS commands with the victim’s local user privileges, which turns this into remote code execution on the desktop application once the malicious content is delivered and rendered.

Technologies

B3Log SiyuanSiyuan-Note Siyuan

Weaknesses

CWE-79CWE-94

CVSS scores

v3.19.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Stealth

T1190Exploit Public-Facing Application T1027.006HTML Smuggling T1027.009Embedded Payloads T1564.009Resource Forking

References

Potentially impacted assets

See if this affects your attack surface

Latest trending attack

Criticalyesterday

Google Brotli decoder - Remote Code Execution via compressed requests (Exploitation Check)

This control is the second step of the Patrowl response to CVE-2026-111497 (Node2Shell). It complements the first control of 22 October 2026, which focused on the Node.js runtime, and does not replace it. Why a second control CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder, the library that decompresses Brotli ("br") data. It was first published as a Node.js vulnerability, because Node.js bundles this decoder. Later publications showed that the flaw is in the library itself. Every product that embeds an affected version of the decoder is concerned, whatever its language or vendor. A public proof of concept demonstrates code execution. Any server that decompresses request bodies sent with "Content-Encoding: br" exposes the decoder to unauthenticated attackers. Known cases include Express 5 and NestJS 11 on Node.js, Koa and Fastify setups, Bun, Envoy and Istio with request decompression enabled, and any application or reverse proxy that decodes Brotli request bodies with an affected library. The flaw also works in the other direction. A malicious server can compromise an unpatched client that decodes a Brotli response, for example Node.js fetch(), Python clients (requests, httpx, aiohttp, Scrapy) with the Brotli or brotlicffi package, or libcurl builds with Brotli support. What this control checks Patrowl sends small, valid Brotli-compressed requests to each asset and observes whether the server decodes them. The check does not depend on the technology: it detects the behaviour, whatever the stack behind it. These requests are what any legitimate client could send. They never reach the vulnerable code path and cannot affect the availability of the service. How to read the result Potentially impacted means the asset decodes Brotli request bodies: the attack surface is exposed. It does not confirm that the asset is vulnerable. The version of the Brotli decoder in use is not visible from the outside. This check covers applications that parse request bodies on their root path. A Not impacted result does not rule out exposure on other routes, nor on the client side. Checking the versions on the servers remains the only exhaustive verification. Affected and fixed versions Google Brotli 1.0.3 to 1.2.0 are affected, fixed in 1.0.10, 1.1.1 and 1.2.1. Fixed releases of the main products embedding it: Node.js 22.23.4, 24.22.1 and 26.12.1 (end-of-life lines 20.x and older and 25.x receive no fix), Bun 1.4.4, Envoy 1.37.8, 1.38.6, 1.39.3 and 1.40.0, Istio 1.29.9, 1.30.6 and 1.31.2, Python Brotli 1.2.1 and brotlicffi 1.2.1.0. Products that link against the system library depend on the Brotli package of the Linux distribution. Recommendations Update every component that embeds the Brotli decoder (only real fix). Start with the assets flagged by this control. Restart the processes after the update. Rebuild containers, single-executable applications and appliances that bundle an affected runtime or library. Reduce the exposure until the update is deployed. Reject requests with "Content-Encoding: br" at the reverse proxy, load balancer or WAF, case-insensitively and including lists such as "gzip, br". On Envoy and Istio, disable request decompression for Brotli. Review outbound calls. List the features that fetch content from servers you do not control, and patch the services that host them first.