SiYuan renders Mermaid diagrams with a securityLevel of "loose" and injects the resulting SVG into the page through innerHTML. This allows Mermaid code blocks containing attacker‑controlled javascript: URLs to persist in the rendered output. When a note containing such a diagram is opened in the desktop Electron version, the application creates a window with nodeIntegration enabled and contextIsolation disabled, turning the stored XSS into arbitrary code execution. This flaw can lead to full compromise of the victim machine if they open a malicious note and interact with the diagram.

The vulnerability applies to the SiYuan Note application, specifically versions 3.6.3 and earlier. Users running these releases on any platform that uses the desktop Electron build are at risk.

The flaw scores a CVSS of 9.1, indicating critical severity. Although EPSS data is not available, the lack of mitigations in affected releases and the need for a victim to open a note suggest a non‑negligible exploitation probability. The issue is not listed in CISA’s KEV catalog, but its high score and the absence of broader protective controls mean that organizations should treat it as critical. The attack requires a crafted Mermaid diagram containing a javascript: link; once a user opens or clicks the diagram in the Electron environment, the stored XSS escalates to code execution because of the insecure configuration of nodeIntegration and contextIsolation.