Shirshakhtml

Selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in `packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/TextNode.tsx` and `packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/FileNode.tsx` to render card content using the full Markdown renderer. These components insert the resulting HTML into the main application document via `dangerouslySetInnerHTML`. A malicious note can inject style elements and remote CSS imports to modify the trusted application chrome, signal when a note is opened, and potentially disclose exposed attribute values. While Content Security Policy prevents inline script execution, the issue allows for CSS injection and UI redressing, which is the act of manipulating the user interface to trick a user into performing an action.

A ByteBuf leak exists in the `StompSubframeDecoder` function. When a frame's declared content-length is fully read, the decoder allocates a chunk buffer and waits for the terminating NUL byte. If this byte is not received, the buffer is not released because the signal thrown by `skipNullCharacter()` extends Error instead of Exception, bypassing the release path. Additionally, the decoder does not override `handlerRemoved0` or `channelInactive`, allowing the buffer to persist after channel teardown. A remote peer can trigger this leak by sending a well-formed frame body without the terminating NUL byte, potentially leading to memory exhaustion as the pooled allocator does not reclaim the memory.

Broken access control in the 'GET /api/v1/organizationuser' endpoint allows any authenticated organization member to retrieve the full user record of the organization owner. This includes the bcrypt password hash and temporary tokens. By querying the endpoint with a specific `user ID`, an attacker can obtain the credential hash for offline cracking, potentially leading to a full account takeover of the most privileged account.

Insufficient validation or escaping of annotation fields written to disk via the 'setFileAnnotation' endpoint allows attackers to inject malicious markup. This markup executes as a script within the PDF renderer, granting full Node.js access when a user opens an annotated PDF.

Stored Cross-Site Scripting (XSS) occurs because attribute-view field names are stored without HTML escaping and interpolated directly into option elements using `innerHTML` within the sort menu. An attacker can inject markup by renaming a database field, allowing the execution of arbitrary JavaScript when a user opens the sort menu. In the desktop client, if Node integration is enabled, this can lead to remote code execution.

Stored cross-site scripting is possible due to a failure to validate or escape the `color` field in attribute-view select options across eight unescaped render sites. An attacker can inject event-handler attributes by including quotation marks in the `color` value, which leads to the execution of arbitrary JavaScript when a user views databases containing the malicious select field.

Stored cross-site scripting is possible due to a failure to validate or escape table column width values, which allows injection into style attributes. An attacker can use the 'setAttrViewColWidth' API to inject malicious payloads that break out of style attributes and insert event handlers on every table cell. This can lead to the execution of arbitrary code within the Electron renderer when Node integration is enabled.

An authentication bypass exists in the WebSocket endpoint due to differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can use a malicious WebSocket URI containing duplicated query parameters to bypass access auth code validation. This allows the attacker to receive the live kernel event stream, which includes document identifiers, titles, and operation logs.

A cross-site scripting issue exists in the `unicode2Emoji()` function due to a failure to sanitize codepoint branch output. This allows attackers to create document icons containing hex-encoded markup. When processed by the renderer with Node integration enabled, this can lead to arbitrary code execution on the host system.

A remote code execution issue exists in the Template calculation operator. The software renders user-authored Go templates and stores the output without sanitization. This allows attackers to inject malicious HTML and JavaScript into template calculations. When the database is opened, these scripts execute in the desktop client renderer with Node integration enabled, leading to arbitrary code execution.

Improper escaping of database menu metadata during HTML interpolation allows stored values to execute scripts when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names to close containing elements and execute arbitrary code via event handlers. This is further exacerbated by an insecure Electron configuration that allows access to Node built-ins.

An information disclosure issue exists in the '/api/filetree/authFilePublishAccess' endpoint, which is accessible anonymously. The endpoint does not return failure codes, instead signaling outcomes through response messages and the presence of a 'Set-Cookie' header. By sending requests with an empty password for a specific document identifier, an attacker can determine if a document is public, nonexistent, password-protected, or located within hidden or forbidden tiers. Additionally, because hidden and forbidden entries use empty passwords, these requests can trigger the server to issue a publish-auth cookie for forbidden documents.

A missing authorization issue exists in the '/api/ref/refreshBacklink' endpoint. This allows anonymous readers to trigger persistent server-side writes by invoking the endpoint with a controlled `block ID`. This action flushes transaction queues, scans all references globally, and enqueues database writes, which bypasses read-only protections and enables resource amplification attacks.

A SQL injection issue exists in the backlink/mention search query within `kernel/model/backlink.go`. The application concatenates stored block metadata (title, name, alias, anchor text) and a client-supplied keyword into a SQL MATCH/search statement, escaping only double-quote characters and failing to escape single quotes. A single quote in the client keyword or stored document metadata allows an attacker to break out of the string literal. Since the query uses a statement-stacking-capable driver on the main read-write `siyuan.db` handle, an attacker can execute arbitrary SQL, enabling unauthorized read and write access across notebooks. This is reachable by anonymous users or those with `RoleReader` permissions on the publish surface.

An information disclosure issue exists in the 'getRefIDsByFileAnnotationID' endpoint. The system returns block identifiers that cite PDF annotations without applying publish-access filtering. This allows attackers to extract block identifiers from restricted documents by providing annotation identifiers visible on published pages, thereby exposing citation relationships across password-protected and forbidden tiers.

An information disclosure issue exists in the 'getAttributeViewBacklinks' endpoint. The system incorrectly consults the forbidden access list instead of the visibility list when filtering backlinks. This allows anonymous readers to provide a publicly visible database row identifier to discover hidden-tier documents that reference it, exposing the database name, row title, and document path of those hidden documents.

A publish-boundary bypass exists in WebSocket broadcast sessions. This allows anonymous readers to establish a WebSocket connection to the publish surface and passively receive real-time content events, including password-protected and forbidden documents, without authentication.

A missing-authorization issue exists in the `/api/av/getAttributeViewSearchTarget` endpoint. The route is registered with CheckAuth only and lacks necessary authorization checks, such as CheckReadonly, publish-access, or encrypted-notebook gating. An anonymous reader can use a database identifier from a published page and a keyword to query the endpoint and retrieve matching database row content, including data that should be withheld by publish filters (FilterAttributeViewByPublishAccess).

An information disclosure issue exists where the '/api/storage/getOutlineStorage' endpoint fails to perform authorization checks. This allows an attacker to retrieve the outline state, including heading identifiers, for any document by providing its identifier, regardless of whether the requester has permission to access the document.

An information disclosure issue exists in the 'getBookmarkLabels' endpoint. The system returns all bookmark labels within the workspace without applying publish-access filtering. This allows anonymous readers and readers in publish-mode to access the complete bookmark vocabulary across the workspace, potentially revealing subject matter and organizational details from documents they are not authorized to access.