SiYuan setFileAnnotation Stored Script Injection to Node.js RCE

Technical Analysis

The vulnerability (CVE-2026-73041, CVSS 9.0) stems from improper input validation and output encoding of annotation metadata persisted to disk by the setFileAnnotation API. Because SiYuan's PDF renderer runs within an Electron context with Node.js integration enabled, injected script in annotation fields escapes the sandbox and executes with full Node.js API access, effectively granting arbitrary code execution, file system access, and potential network pivoting on the victim's machine. Exploitation requires only that a victim open a maliciously annotated PDF within SiYuan, making this suitable for supply-chain-style distribution via shared knowledge bases, plugin repositories, or collaborative note vaults. Organizations increasingly use SiYuan and similar note-taking tools as local knowledge stores feeding RAG pipelines or as a workspace for AI coding/research agents with file-system and shell access; a compromised SiYuan instance could allow attackers to exfiltrate API keys, poison ingested documents used by an agent's retrieval layer, or pivot into agent orchestration environments running on the same host.

Affected Systems

SiYuan (all platforms: Windows, macOS, Linux, and Docker/self-hosted deployments) versions prior to v3.7.4, specifically installations exposing or utilizing the setFileAnnotation endpoint for PDF annotation storage and rendering.

Indicators of Compromise

• Malicious PDF files with crafted annotation metadata (file names vary)
• Anomalous setFileAnnotation API calls containing script-like payloads (e.g., <script>, javascript:, onerror= in annotation fields)
• Unexpected Node.js child process spawning from SiYuan application process
• Modified or unexpected .sy/.json annotation storage files within SiYuan workspace directories

Remediation Steps

1. 1

   Upgrade SiYuan

   Update all SiYuan installations to v3.7.4 or later, which patches the annotation sanitization flaw.

2. 2

   Restrict PDF sources

   Do not open PDF files or shared workspaces from untrusted or unverified sources until patched.

3. 3

   Disable Node integration where possible

   Review Electron configuration to minimize Node.js integration exposure for renderer processes handling untrusted content.

4. 4

   Audit workspace annotations

   Scan existing annotation data/files for suspicious script-like content prior to and after upgrade.

5. 5

   Isolate knowledge-management hosts

   For environments where SiYuan feeds RAG pipelines or AI agent workflows, run the application in an isolated/sandboxed environment separate from systems holding API keys or agent credentials.