A stored cross-site scripting flaw in SiYuan's database menu handling lets attacker-supplied field metadata execute script in the application context, which, through the Electron desktop client's insecure configuration, is reported to escalate to remote code execution on the host.
What Is It
SiYuan before v3.7.4 fails to properly escape database menu metadata during HTML interpolation. Stored values execute script when a user opens group, view, or field-edit menus. An attacker can inject markup through field descriptions or names that closes the containing element and fires arbitrary code via event handlers. Because the Electron shell is configured insecurely, that injected script reaches Node built-ins; turning a classic stored XSS (CWE-79) into what the advisory describes as arbitrary code execution on the victim's machine.
The flaw carries a CVSS 3.1 base score of 9.0 (CRITICAL): AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, and a CVSS 4.0 score of 9.4 (CRITICAL). Both vectors reflect network reach, low attack complexity, and a scope change from the browser context into the underlying host.
Why It Matters
Exploitation needs only low privileges and passive user interaction: the payload is planted once in a database field name or description, then detonates whenever a user opens the relevant menu. In a shared or collaborative workspace, this suggests a low-privilege contributor could potentially obtain code execution on other users' endpoints, though the practical reach will depend on deployment model, client type, and who opens the affected menus. The scope-changed rating (S:C) is the key detail; per the CVSS vector, impact is not expected to stop at the application boundary. Confidentiality, integrity, and availability impacts are rated HIGH for both the vulnerable component and the subsequent system.
No CISA KEV entry accompanies this record, so there is no confirmed evidence of active exploitation at this time and no federal remediation deadline attached.
What's Vulnerable
- Vendor/product: siyuan-note / SiYuan
- Package:
pkg:golang/github.com/siyuan-note/siyuan/kernel - Affected: all versions before 3.7.4
- Unaffected: 3.7.4 and later
The Electron desktop client is the reported path to full code execution, owing to its insecure configuration.
Patch Status
Fixed in SiYuan v3.7.4. Upgrade to 3.7.4 or later. The NVD record was published 2026-08-15 and remains in Received status, so enrichment (including CPE data) is still pending.