A stored cross‑site scripting flaw is present in the Attribute View component of the Siyuan note application. When a value is entered into a template column, the application renders that value as raw HTML using the text/template engine without proper escaping. The only protection applied checks for unclosed tags, so balanced self‑closing tags such as <img> are ignored. An attacker can therefore inject a payload like <img src=x onerror='...'> into the database. When the desktop renderer, which runs with nodeIntegration enabled, loads the page, the payload is inserted into the DOM via innerHTML, executes JavaScript, and gains access to Node APIs through the require function, ultimately allowing arbitrary system command execution. The result is a full compromise of the user’s local machine, affecting confidentiality, integrity, and availability. The provided information does not explicitly state how the malicious content is introduced; it suggests that it occurs when a template column value is stored. The inferred attack vector is that an attacker must be able to write or modify a database entry that will later be viewed by the application. The vulnerability is a classic example of CWE‑79, stored XSS that leads to code execution.

All installations of the Siyuan note desktop application running version 3.7.1 or earlier are affected. The flaw resides in the Attribute View database rendering logic used by any platform that launches the application with nodeIntegration enabled. Affected vendors and product identifiers include siyuan-note:siyuan.

The CVSS score of 9.4 indicates a high‑severity flaw capable of full system compromise. The EPSS score of <1% shows that, as of the last assessment, active exploitation is unlikely, but the potential for future exploitation remains because the vulnerability can be abused by anyone who can create or modify a database entry. The risk is amplified by the fact that the flaw requires no special network component or external input; local or formally authorized users are enough. No remote exploitation vector is explicitly described in the available information.