GHSA-4663-4mpg-879v SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering
Stored XSS to RCE via Unsanitized Bazaar README RenderingSummarySiYuan's Bazaar (community marketplace) renders package README content without HTML sanitization. The backend `renderREADME` function uses `lute.New()` without calling `SetSanitize(true)`, allowing raw HTML embedded in Markdown to pass through unmodified. The frontend then assigns the rendered HTML to `innerHTML` without any additional sanitization. A malicious package author can embed arbitrary JavaScript in their README that executes when a user clicks to view the package details. Because SiYuan's Electron configuration enables `nodeIntegration: true` with `contextIsolation: false`, this XSS escalates directly to full Remote Code Execution.Affected Component**README rendering (backend)**: `kernel/bazaar/package.go:635-645` (`renderREADME` function)**README rendering (frontend)**: `app/src/config/bazaar.ts:607` (`innerHTML` assignment)**Electron config**: `app/electron/main.js:422-426` (`nodeIntegration: true`, `contextIsolation: false`)Affected VersionsSiYuan <= 3.5.9Severity**Critical** — CVSS 9.6 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)CWE-79: Improper Neutralization of Input During Web Page Generation (Stored XSS)Note: This vector requires one click (user viewing the package README), unlike the metadata vector which is zero-click.Vulnerable CodeBackend: `kernel/bazaar/package.go:635-645`Compare with SiYuan's own note renderer in `kernel/util/lute.go:81`, which **does** sanitize:This inconsistency demonstrates that the project is aware of the Lute sanitization API but failed to apply it to Bazaar content.Frontend: `app/src/config/bazaar.ts:607`The backend returns unsanitized HTML, and the frontend blindly assigns it to `innerHTML` without any client-side sanitization (e.g., DOMPurify).Electron: `app/electron/main.js:422-426`Any JavaScript executing in the renderer has direct access to Node.js APIs.Proof of ConceptStep 1: Create a malicious READMECreate a GitHub repository with a valid SiYuan plugin/theme/template structure. The `README.md` contains embedded HTML:The raw `<img>` tag with `onerror` handler is valid Markdown (HTML passthrough). The Lute engine preserves it because `SetSanitize(true)` is not called. The frontend renders it via `innerHTML`, and the broken image triggers `onerror`, executing `calc.exe`.Step 2: Submit to BazaarSubmit the repository to the SiYuan Bazaar via the standard community contribution process.Step 3: One-click RCEWhen a SiYuan user browses the Bazaar, sees the package listing, and clicks on it to view the README/details, the unsanitized HTML renders in the detail panel. The `onerror` handler fires, executing arbitrary OS commands.Escalation: Reverse shellEscalation: Multi-stage payload via READMEA more sophisticated attack can hide the payload deeper in the README to avoid casual review:This payload:Uses `onload` instead of `onerror` (fires on successful image load from attacker's server)Exfiltrates SiYuan API token, config, hostname, username, and platform infoInstalls cross-platform persistence (Windows scheduled task / Linux crontab)Is buried inside a legitimate-looking `<picture>` element that blends with real README contentEscalation: SVG-based payload (bypasses naive img filtering)Escalation: Details/summary element (interactive trigger)The `open` attribute causes `ontoggle` to fire immediately without user interaction with the element itself.Attack ScenarioAttacker creates a legitimate-looking GitHub repository with a SiYuan plugin/theme/template.The README contains a well-crafted payload hidden within legitimate-looking content (e.g., inside a `<picture>` tag, `<details>` block, or `<svg>`).Attacker submits the package to the SiYuan Bazaar via the community contribution process.A SiYuan user browses the Bazaar and clicks on the package to view its details/README.The backend renders the README via `renderREADME()` without sanitization.The frontend assigns the HTML to `innerHTML`.The injected JavaScript executes with full Node.js access.The attacker achieves RCE — reverse shell, data theft, persistence, etc.Impact**Full remote code execution** on any SiYuan desktop user who views the malicious package README**One-click** — triggered by viewing package details in the Bazaar**Supply-chain attack** via the official SiYuan community marketplacePayloads can be deeply hidden in legitimate-looking README content, making code review difficultCan steal API tokens, SiYuan configuration, SSH keys, browser credentials, and arbitrary filesCan install persistent backdoors across Windows, macOS, and LinuxMultiple HTML elements can carry payloads (`img`, `svg`, `details`, `picture`, `video`, `audio`, `iframe`, `object`, `embed`, `math`, etc.)Affects all platforms: Windows, macOS, LinuxSuggested Fix1. Enable Lute sanitization for README rendering (`package.go`)2. Add client-side sanitization as defense-in-depth (`bazaar.ts`)3. Long-term: Harden Electron configuration
CVSS v4.0 score: 5.3