Technical impact
The vulnerability is a stored cross‑site scripting flaw that allows an attacker with edit permissions to embed malicious JavaScript by using KaTeX \href, \url, or \includegraphics commands inside math blocks. When the content is later rendered, the KaTeX renderer injects the link into the page via innerHTML, and clicking the link evaluates the malicious script in the owner’s browser context, giving the attacker the ability to execute arbitrary code, steal session cookies, or modify the content viewed by other users.
Affected Systems
SiYuan Note, the personal knowledge‑management application, is impacted in versions 2.10.0 up to, but not including, 3.8.7. This includes all releases that do not incorporate the fix introduced in 3.8.7 or later. No other products or versions are known to be affected according to the CNA data.
Risk and Exploitability
The CVSS score of 5.1 denotes moderate severity, and the available information does not indicate the vulnerability is present in the CISA KEV list. Because exploitation requires a user with edit rights and a second user to view and click the embedded link, the attack surface is limited to environments where untrusted users can edit documents. Once the payload is viewed, the script is executed under the application origin, making it a significant risk for internal user compromise if the edit privilege is mis‑assigned or if an attacker has compromised an editor’s account.
