Medium · published January 19, 2026
⚠️ SiYuan has a sneaky stored XSS vulnerability that lets attackers inject malicious HTML attributes into dynamic icons! This issue affects all versions before 3.5.4! Think of it like a restaurant that allows customers to put whatever they want on their orders without checking the ingredients. If a chef isn’t careful, someone might sneak in something harmful that ends up on everyone’s plate! An attacker can exploit this vulnerability to inject harmful scripts that get stored and rendered later. This could lead to data theft, session hijacking, or even remote code execution in certain environments—absolutely devastating!
Think of it like a restaurant that allows customers to put whatever they want on their orders without checking the ingredients. If a chef isn’t careful, someone might sneak in something harmful that ends up on everyone’s plate! This stored XSS vulnerability in SiYuan allows injection of arbitrary HTML attributes via the `/api/attr/setBlockAttrs` API, which are then executed in an unsanitized context in the dynamic icons feature, enabling potential remote code execution.
An attacker can exploit this vulnerability to inject harmful scripts that get stored and rendered later. This could lead to data theft, session hijacking, or even remote code execution in certain environments—absolutely devastating! Upgrade to SiYuan version 3.5.4 immediately to patch this vulnerability. Ensure you review your application for any unauthorized scripts and implement proper input sanitization for the dynamic icon feature. Regularly audit your APIs to catch any sneaky vulnerabilities! You've got this! With a quick upgrade and some vigilance, you'll have your system locked down tight! 🛡️