CVE-2026-39846 — kernel

Summary

A malicious note synced to another user can trigger remote code execution in the SiYuan Electron desktop client. The root cause is that table caption content is stored without safe escaping and later unescaped into rendered HTML, creating a stored XSS sink. Because the desktop renderer runs with nodeIntegration enabled and contextIsolation disabled, attacker-controlled JavaScript executes with access to Node.js APIs. In practice, an attacker can import a crafted note into a synced workspace, wait for the victim to sync, and achieve code execution when the victim opens the note.

Details

The vulnerability exists in the table caption handling path. When a table block is parsed, the caption attribute is saved into the node's IAL properties without proper HTML escaping. Later, during rendering, that value is read back, passed through HTML unescaping, and written directly into the output DOM. This turns an attacker-controlled caption into active HTML inside the rendered note.

I confirmed that a crafted table caption containing encoded HTML such as <img src=x onerror=...> is rendered as a live DOM element instead of inert text. This makes the issue a stored XSS. I also confirmed that the most practical delivery path is not Markdown import, but a crafted .sy.zip note imported into a synced workspace. Once synced to another desktop client, opening the note executes the payload automatically.

In the Electron desktop client, this XSS results in code execution rather than browser-only script execution. The renderer is configured with nodeIntegration: true and contextIsolation: false, so JavaScript running in the note context can call Node.js APIs directly. A payload such as require('child_process').exec('calc') executes successfully, demonstrating code execution on the victim machine in the context of the logged-in user.

PoC

• SiYuan Desktop Client A: attacker
• SiYuan Desktop Client B: victim
• Both clients are configured to use the same sync target

PoC File

I created a malicious .sy.zip note containing a table block with a crafted caption property.

Safe validation payload:

<img src=x onerror=alert('caption-xss')>

RCE validation payload on Windows:

<img src=x onerror=require('child_process').exec('calc')>

Steps to Reproduce

1.On Client A, import the crafted .sy.zip note using:

Import -> SiYuan .sy.zip

2.Confirm the imported note appears in the workspace.

3.Trigger sync on Client A so the malicious note is uploaded to the shared sync target.

4.On Client B, trigger sync so the note is downloaded from the shared sync target.

5.Open the synced note on Client B.

Observed Result

With the safe payload, JavaScript executes automatically when the victim opens the note. With the RCE payload, the Electron renderer executes:

require('child_process').exec('calc')

This launches Calculator on Windows, demonstrating code execution in the victim user's context.

Impact

• Impact Across All Platforms: Stored XSS
• Electron Desktop App: Remote Code Execution