SiYuan desktop versions prior to 3.7.2 are vulnerable to a reflected cross-site scripting attack that can be leveraged to achieve full remote code execution with Node.js privileges.

The application improperly handles input within the bazaar plugin readme handler, allowing an attacker to inject malicious HTML payloads via a crafted siyuan:// deep link. Due to an insecurely configured Electron renderer, these scripts execute with full Node.js access, effectively bypassing traditional browser-based sandbox protections.

The ability to execute arbitrary code with Node.js privileges grants an attacker complete control over the host system. This level of compromise can lead to the theft of local files, installation of persistent malware, or lateral movement within the user's environment, warranting a critical severity rating.

Immediate Action: Update the SiYuan desktop application to version 3.7.2 or later to apply the necessary security fixes for the renderer configuration.

Proactive Monitoring: Monitor endpoint logs for suspicious child processes spawned by the SiYuan application or unexpected network connections originating from the desktop client.

Compensating Controls: Exercise caution when clicking on unrecognized deep links, especially those formatted as siyuan:// protocols, as these are the primary vector for this attack.

Public Exploit Available: Unknown

The transition from cross-site scripting to full code execution is a high-impact event that necessitates an immediate software update. Users are strongly advised to upgrade to version 3.7.2 immediately to neutralize this threat.