SiYuan before version 3.8.4 fails to HTML‑escape user‑supplied flashcard content before inserting it into the card‑manager list markup. The vulnerable endpoint returns the content, which is then assigned to a DOM element’s innerHTML. An attacker can embed executable JavaScript, such as an image tag with an onerror handler, that will run in the context of the application. Because the SiYuan desktop uses Electron with nodeIntegration enabled and contextIsolation disabled, this script executes with renderer process privileges, allowing an attacker to run arbitrary code on the host system. The impact is thus the ability to execute attacker‑supplied code with full desktop privileges, leading to potential data theft or system compromise.

The vulnerability affects the SiYuan note‑taking application, specifically all releases prior to 3.8.4. Users running older SiYuan versions on any operating system that uses the desktop Electron build are susceptible. No other outlined vendors or products are impacted.

The CVSS score of 8.6 classifies this as a high‑severity flaw. The EPSS score is not available, but the risk remains high because the flaw requires the attacker to supply flashcard content, which typically involves contributing or importing user content. The vulnerability is not listed in the CISA KEV catalog, yet the attack vector relies on privileged renderer access; an administrator who opens the card manager in a workspace containing malicious content will trigger code execution. The exploit does not bypass authentication or authorization but exploits the untrusted‑content‑to‑privileged‑renderer problem.