SiYuan versions before 3.7.4 allow an attacker to inject arbitrary HTML and JavaScript through the template calculation operator, which renders user‑authored Go templates and stores the result verbatim without any sanitization. This flaw is a classic example of uncontrolled input leading to injection, classified as CWE‑79. When a maliciously crafted template is processed, the embedded code is executed in the desktop client’s renderer that has Node integration enabled, giving the attacker full control of the host system. The result is a full remote code execution capability that can be triggered simply by opening the compromised database file.

Siyuan Note, version SiYuan before v3.7.4. The vulnerability affects all installations of the desktop client running the older release line, regardless of operating system, as the issue resides in the application logic itself.

The CVSS score of 9.4 indicates an exploit that can occur without authentication and provides complete compromise of the affected system. Exploitation requires the attacker to supply a malicious database containing the crafted template; the Node integration in the renderer must be enabled for the attack to succeed. The EPSS score is not available, but the lack of listing in the CISA KEV catalog suggests that public exploitation is not yet widespread. Nevertheless, the high severity and the simplicity of the trigger make this flaw a high‑priority risk for all affected users.