A critical remote code execution vulnerability in the SiYuan desktop client allows an attacker to execute arbitrary code when a malicious database is opened.

This is a cross-site scripting (CWE-79) and remote code execution vulnerability originating from the Template calculation operator. The operator fails to sanitize user-authored Go templates, which are rendered with Node integration enabled in the desktop client.

Successful exploitation allows an attacker to achieve code execution on the host machine running the SiYuan desktop client. This could lead to local data theft, lateral movement within the network, or complete control over the user's workstation, justifying the critical severity rating.

Immediate Action: Upgrade the SiYuan desktop client to version 3.7.4 or later immediately.

Proactive Monitoring: Users should exercise caution when opening database files from untrusted sources and monitor for unexpected application behavior or unauthorized network connections.

Compensating Controls: Ensure the application is run with the least privilege necessary and utilize endpoint protection software to detect unauthorized child processes spawned by the SiYuan client.

Public Exploit Available: No.

All users of the SiYuan desktop client must update to version 3.7.4 to remediate this vulnerability. Given the ease with which local code execution can occur, users should avoid opening untrusted or shared SiYuan database files until the software has been patched.