A critical stored cross-site scripting vulnerability in SiYuan allows authenticated users to achieve remote code execution through manipulated menu metadata.

The application fails to properly escape database menu metadata during HTML interpolation. This flaw allows an authenticated user to inject malicious markup that executes arbitrary JavaScript, which, due to the application's use of Electron with insecure configuration, can escalate to full remote code execution.

The ability to execute arbitrary code with the privileges of the application provides an attacker with complete control over the user's local system. Given the CVSS score of 9.0, this represents a critical risk to confidentiality, integrity, and availability, as it allows for data exfiltration and total compromise of the host environment.

Immediate Action: Upgrade to SiYuan version 3.7.4 or later immediately.

Proactive Monitoring: Monitor for unusual script execution or unexpected outbound network connections from the SiYuan application process.

Compensating Controls: Restrict permissions on database fields and views to trusted users only until the patch is applied.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk due to the potential for remote code execution. Users are strongly advised to apply the version 3.7.4 update immediately to secure the application against potential exploitation.