SiYuan’s Asset.render routine places the asset path directly into an HTML element’s innerHTML without sanitizing the value. A crafted asset link that contains a "double quote" can terminate the src attribute and inject an event handler, allowing the attacker to run arbitrary JavaScript within the Electron renderer. The injected script has the capability to execute OS commands, thereby providing full control over the host machine. This flaw therefore results in remote code execution with the privileges of the Electron renderer process.

The vulnerability exists in releases of the prior to version 3.7.1. The issue was addressed in the 3.7.1‑alpha.2 and 3.7.1 stable releases. Users running earlier versions of Siyuan should be aware that asset links containing "double quotes" can be used to trigger the flaw.

The CVSS score of 8.6 classifies the vulnerability as high severity. The EPSS score of < 1% indicates a very low but non-zero exploitation probability; however, the lack of a KEV listing does not diminish the risk posed by the ability to execute system commands from within the application. The attack vector is inferred from the description: a malicious payload can be delivered via a crafted asset link that a user opens in Siyuan, leading to execution of arbitrary code in the renderer process. Consequently, the risk is significant for any user who permits the loading of untrusted asset links. The vulnerability can be exploited without additional software or special network access, and it can affect all users of affected versions.