A critical vulnerability in SiYuan Note allows for remote code execution via stored cross-site scripting when a user imports a specially crafted document.

This flaw stems from improper neutralization of input during web page generation (CWE-79), where crafted block attributes bypass server-side escaping. Because the Electron desktop client environment grants access to Node APIs, the injected JavaScript results in remote code execution (CWE-94) when a victim opens a malicious note.

The potential for remote code execution poses a severe risk to organizational security, as an attacker can gain full control over the host system. Given the CVSS score of 8.6, this vulnerability is classified as High and requires immediate attention to prevent unauthorized access, data theft, or complete system compromise.

Immediate Action: Update all instances of the SiYuan desktop client to version 3.6.2 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Review file import logs and monitor for unusual activity originating from the SiYuan process, particularly any attempts to execute shell commands or spawn unexpected child processes.

Compensating Controls: Implement strict file validation policies that restrict the import of untrusted .sy.zip files from external sources until all endpoints are updated.

Public Exploit Available: Unknown

Given the transition from a client-side scripting flaw to a full remote code execution primitive, this vulnerability represents a significant risk to any user relying on the SiYuan desktop application. Organizations should prioritize patching all installations to version 3.6.2 without delay to eliminate the underlying attack vector.