SiYuan versions prior to v3.7.4 improperly escape menu metadata when rendering HTML, allowing stored values to execute scripts. An attacker can inject markup in field descriptions or names that close existing elements and attach arbitrary JavaScript to event handlers. The Electron configuration used by SiYuan permits the renderer to access Node.js built‑ins, so the malicious code can run with the full privileges of the host process, resulting in remote code execution over the local machine.

The vulnerability affects the SiYuan note-taking application from Siyuan Note. All releases before v3.7.4 are impacted; the fix is included in v3.7.4 and later.

The CVSS score is 9.4, indicating a high‑severity flaw. EPSS data is not available, and the flaw is not listed in the KEV catalog, so precise exploitation probabilities are unknown. The flaw requires the attacker to supply malicious menu metadata, which is later rendered when a user opens group, view, or edit menus. Because the Electron instance is configured insecurely, the injected script gains access to Node.js, allowing arbitrary code execution. The likely attack vector is a locally interactive attack where a compromised or malicious user can insert malicious metadata that later triggers when any user opens the affected menus.