A stored cross-site scripting vulnerability in SiYuan can lead to arbitrary code execution when malicious attribute names are viewed by a user, particularly within the desktop client.

The application fails to sanitize attribute-view field names, which are rendered via innerHTML in the sort menu. An authenticated attacker can rename a database field to include malicious scripts that execute in the context of the victim's session.

The impact is severe, as the vulnerability allows for arbitrary JavaScript execution. In the context of the SiYuan desktop client, where Node integration may be enabled, this vulnerability can escalate to full system command execution, threatening the integrity and confidentiality of the host environment.

Immediate Action: Update the SiYuan software to version 3.7.4 or later, which includes the necessary output encoding to prevent script injection.

Proactive Monitoring: Monitor for unusual modifications to database field names that contain HTML tags or script-related keywords.

Compensating Controls: Ensure that users are not granted unnecessary privileges to modify database structures and employ Content Security Policy (CSP) headers where applicable.

Public Exploit Available: No (exploit_available: false)

While this vulnerability requires an authenticated user to initiate the injection, the potential for escalation to remote code execution in the desktop client is significant. Administrators should apply the update to version 3.7.4 as soon as possible to neutralize this stored XSS vector.