SiYuan, an open‑source personal knowledge management system, suffered a stored cross‑site scripting flaw in the attribute‑view cell renderer. The function genAVValueHTML interpolated cell values directly, allowing someone to embed HTML that breaks out of a surrounding element and executes JavaScript when the block‑attribute panel is opened. Because the Electron desktop build runs with nodeIntegration enabled, the malicious script can call Node.js APIs such as require('child_process'), elevating the XSS into a remote code execution vulnerability. The flaw is grounded in CWE‑79 (Cross‑Site Scripting) and CWE‑1188 (Improper Content Handling).

The vulnerability affects all Siyuan deployments running a version earlier than 3.7.0. In those environments, any cell in the attribute view that contains a malicious payload—such as a closing textarea tag or an image tag with an onerror handler—will be rendered verbatim. Users or collaborators with write access to a synced workspace can embed such payloads; the payload persists unchanged across devices and triggers on every device that opens the corrupted block‑attribute panel.

The CVSS score of 9.9 indicates a critical risk. The EPSS score is not available, but the absence of this metric does not diminish the inherent severity of the flaw. The vulnerability is not listed in CISA KEV, yet its exploit path remains straightforward: an attacker must be able to write to a synced workspace and subsequently entice a user to view the block‑attribute panel. Once the XSS succeeds, the local Electron environment provides direct access to the operating system, allowing arbitrary code execution. The attack can be performed without additional network interaction beyond the normal sync traffic, making it highly plausible in collaborative settings.