{“lastseen”:””,”description”:”SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, he tooltip mouseover handler in app\/src\/block\/popover.ts reads aria-label via getAttribute and passes it through decodeURIComponent before assigning to messageElement.innerHTML in app\/src\/dialog\/tooltip.ts:41. The encoder used at the producer side, escapeAriaLabel in app\/src\/util\/escape.ts:19-25, only handles HTML special characters (\\”, ‘, \\u003c, literal \\u0026lt;) \u2014 it leaves %XX URL-escapes untouched. So a doc title containing %3Cimg src=x onerror=…%3E round-trips through escapeAriaLabel and the HTML attribute layer unmodified. Then decodeURIComponent on the consumer side converts %3C to a literal \\u003c character (a real \\u003c, NOT a character reference). When that string is assigned to innerHTML, the HTML5 tokenizer enters TagOpenState on the literal \\u003c, parses the \\u003cimg\\u003e element, and the onerror handler fires. Because the renderer runs with nodeIntegration: true, contextIsolation: false, webSecurity: false (app\/electron\/main.js:407-411), require(‘child_process’) is reachable from the injected handler, escalating to arbitrary code execution.This vulnerability is fixed in 3.7.0.”,”published”:”2026-05-14T18:23:27.595Z”,”modified”:”2026-05-14T18:23:27.595Z”,”type”:”cve”,”title”:”SiYuan: URL-encoded title bypasses `escapeAriaLabel`, decoded by `decodeURIComponent` into a tooltip-XSS”,”source”:”GitHub_M”,”references”:”https:\/\/github.com\/siyuan-note\/siyuan\/security\/advisories\/GHSA-25rp-h46x-2hjm”,”id”:”CVE-2026-44588″,”bulletinFamily”:””,”cwe”:[“CWE-79″,”CWE-116″,”CWE-1188″],”cvelist”:null,”sourceData”:”siyuan-note siyuan \\u003c 3.7.0″,”sourceHref”:””,”cvss”:{“score”:9.4,”severity”:”CRITICAL”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:A\/VC:H\/VI:H\/VA:H\/SC:H\/SI:H\/SA:H”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”siyuan”,”version”:”\\u003c 3.7.0″,”vendor”:”siyuan-note”,”ai_description”:”URL-encoded title bypasses escapeAriaLabel, decoded by decodeURIComponent into a tooltip-XSS, allowing arbitrary code execution”,”ai_severity”:”Critical”,”ai_vendor”:”siyuan-note”,”ai_product”:”SiYuan”,”ai_version”:”\\u003c 3.7.0″,”ai_score”:9.4}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, he tooltip mouseover handler in app\/src\/block\/popover.ts reads aria-label via getAttribute and passes it through…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[9,6,8,131,12,13,7,11,5],"class_list":["post-54634","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-critical","tag-cve","tag-cvss","tag-cvss-94","tag-exploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n