A critical stored cross-site scripting vulnerability in SiYuan allows unauthenticated attackers to achieve remote code execution on the host machine.

The application fails to properly sanitize user input in the Attribute View database cell rendering, allowing the injection of malicious HTML. Because the desktop renderer runs with nodeIntegration enabled, this cross-site scripting flaw can be escalated to full arbitrary command execution.

A successful exploit allows an attacker to execute arbitrary commands on the underlying host system, leading to complete system compromise. With a CVSS score of 9.6, this vulnerability represents an extreme risk to data confidentiality, integrity, and availability, potentially allowing attackers to exfiltrate sensitive notes or deploy persistent malware.

Immediate Action: Update the SiYuan application to version 3.7.2 or higher immediately to apply the necessary input sanitization fixes.

Proactive Monitoring: Review application logs for unusual database queries or unexpected rendering of HTML tags in the Attribute View.

Compensating Controls: While a patch is available, users should restrict the application's network access to prevent potential callbacks to attacker-controlled infrastructure.

Public Exploit Available: Unknown

Given the critical severity and the potential for remote code execution, organizations must prioritize upgrading to version 3.7.2. Any delay in patching leaves the host system vulnerable to total compromise via standard user interaction with the database interface.