A critical cross-site scripting vulnerability in the SiYuan protocol handler permits unauthenticated attackers to execute arbitrary commands on the local operating system.

The application incorrectly handles the icon parameter within the siyuan:// protocol handler, injecting unescaped input into the tab header. This cross-site scripting flaw exploits the enabled nodeIntegration setting to access Node.js primitives and execute system-level commands.

The vulnerability poses a severe threat, as it enables an attacker to gain full control over the user's desktop environment. A CVSS score of 9.6 reflects the ease of exploitation and the critical impact, which includes unauthorized access to local files and potential lateral movement within the network.

Immediate Action: Upgrade to SiYuan version 3.7.2 or later to ensure the protocol handler correctly sanitizes input parameters.

Proactive Monitoring: Monitor for suspicious protocol handler triggers or attempts to pass malformed arguments to the SiYuan application.

Compensating Controls: Disable the ability for the browser or other applications to automatically launch the siyuan:// protocol if business requirements allow.

Public Exploit Available: Unknown

This vulnerability demands immediate attention due to the high risk of command execution. Administrators should ensure all deployments are updated to version 3.7.2, as this is the only effective method to remediate the underlying flaw in the protocol handler.