SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renamin…
严重 CVSS 9.0
摘要
SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node integration enabled in the desktop client enabling code execution.
中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。
深度研判
该漏洞尚未生成深度研判报告（DR-003 v2 AI pipeline 建设中）。
数据来源
- NVD DATABASE
原始链接
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-g3jx-227v-x2x4
- https://www.vulncheck.com/advisories/siyuan-before-stored-xss-via-attribute-view-field-names
时间线
- nvd_ingest NVD