Lute, the Markdown engine used by SiYuan, contains a stored XSS flaw in versions 1.7.6 and earlier. An attacker can embed malicious JavaScript inside a Markdown note; when another user clicks the rendered content, the script runs in the victim’s browser session. The weakness arises from improper sanitization of hyperlink targets, classified as CWE‑79.

Affected systems include SiYuan note version 3.5.4 and any earlier builds that embed Lute 1.7.6. Any deployment that uses the vulnerable engine is susceptible, regardless of the operating system environment.

The CVSS score of 4.6 indicates moderate impact, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to create or modify a note containing the malicious hyperlink, implying a collaborative or shared documentation scenario is needed.