Remote Code Execution in SiYuan via Malicious Bookmark Labels

SiYuan versions prior to 3.8.4 contain a critical vulnerability that allows attackers to achieve remote code execution (RCE). The application fails to properly sanitize or escape bookmark labels when importing and rendering .sy notebook files within the dock tree. Because the underlying Electron framework is configured with nodeIntegration enabled, the rendering of malicious HTML payloads within these bookmark attributes allows for the execution of arbitrary JavaScript. This execution occurs within the context of the renderer process, granting the attacker access to Node.js primitives, including the child_process module, which can be leveraged to execute arbitrary system commands on the host machine. This affects all platforms where SiYuan is deployed, as it relies on the Electron-based architecture.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands with the privileges of the user running the SiYuan application. This can lead to full system compromise, data exfiltration, or the installation of persistent backdoors. The vulnerability is highly severe because it does not require complex infrastructure, only the victim's interaction with a malicious .sy file.

Recommendation

• Upgrade all SiYuan installations to version 3.8.4 or later immediately.
• Restrict the import of untrusted or externally sourced .sy notebook files until patches are applied.
• Review endpoint telemetry for suspicious process execution patterns originating from the SiYuan process tree.