A critical stored cross-site scripting vulnerability in SiYuan allows authenticated attackers to execute arbitrary code with Node integration enabled.

This is a CWE-79 vulnerability where improper validation of table column width values permits malicious injection into style attributes. The vulnerability requires low privileges and user interaction, allowing an attacker to inject event handlers that trigger code execution in the Electron environment.

The exploitation of this vulnerability results in full system compromise, as the application runs with Node integration enabled. Given the CVSS score of 9.0, this represents a critical risk where an attacker can gain unauthorized control over the host system, leading to data exfiltration or total loss of system integrity.

Immediate Action: Update siyuan-note siyuan to version 3.7.4 or later to apply the necessary input validation and sanitization fixes.

Proactive Monitoring: Review application logs for unusual API calls to setAttrViewColWidth and monitor for unexpected process spawning from the SiYuan application.

Compensating Controls: Implement strict Content Security Policy (CSP) headers if possible to restrict the execution of unauthorized scripts within the application interface.

Public Exploit Available: No

This vulnerability presents a severe risk to host system integrity. All administrators should prioritize updating to version 3.7.4 immediately to remediate this flaw and prevent potential remote code execution.