SiYuan Note before version 3.7.4 accepts document metadata fields such as bookmark, alias, memo, and an alternate name without proper escaping, allowing a malicious user to embed a double quote that breaks out of an aria‑label attribute. The injected code can contain inline event handlers like onmouseover, which, when a victim simply hovers over the entry in a move or link dialog, executes JavaScript in the renderer process. Because the application is built with Electron configured for nodeIntegration:true, contextIsolation:false, and without a content security policy, the injected handler can call require('child_process') and run arbitrary operating‑system commands, elevating the XSS to a full remote code execution vulnerability.

All SiYuan builds released before 3.7.4, including the default Electron configuration with nodeIntegration enabled and no content‑security policy. Any instance that uses the move or link to dialog for selecting a file path is susceptible, regardless of the operating system on which SiYuan runs.

The vulnerability carries a CVSS score of 9.3, indicating critical severity, and is not listed in CISA’s Known Exploited Vulnerabilities catalog. The EPSS score is < 1%, indicating a very low but nonzero likelihood of exploitation, but the flaw can be leveraged with minimal effort by sharing a malicious document via sync, import or direct sharing. An attacker only needs to place a document with problematic metadata in a shared folder; any user who opens a file‑selection dialog that reveals this entry will trigger the exploit simply by hovering. The high severity and the ease of trigger make this a high‑risk vulnerability for organizations that use SiYuan to manage documents.