SiYuan versions prior to 3.7.4 do not validate or escape values used for table column widths, allowing an attacker to store a cross‑site scripting payload that breaks out of a style attribute. The injected payload is then executed as an event handler on every table cell, which runs arbitrary JavaScript inside the Electron renderer with Node integration enabled. This flaw is a classic stored XSS (CWE‑79) that can lead to arbitrary code execution on the victim’s machine.

The vulnerability affects the Siyuan Note application from Siyuan-note. All releases before v3.7.4 are vulnerable; any installation using those versions may process malicious column‑width inputs.

The CVSS score of 9.4 indicates high severity, and while EPSS is not available the flaw is listed as not present in the KEV catalog, suggesting no known widespread exploitation yet. A likely exploitation path is an attacker controlling the content that a user opens: a malicious document can embed a specially crafted column width value through the setAttrViewColWidth API or by editing the file directly. When the file is opened in a user’s environment with Node integration enabled, the stored XSS executes and developers can run arbitrary code with the application’s privileges.