A critical cross-site scripting vulnerability in the SiYuan unicode2Emoji function permits attackers to execute arbitrary code on the host system.

This is a CWE-79 vulnerability resulting from improper sanitization of codepoint branch output. By crafting specific document icons with hex-encoded markup, an authenticated attacker can execute arbitrary code within the renderer, which runs with Node integration enabled.

The vulnerability is rated as critical with a CVSS score of 9.0. It allows an attacker to bypass application-level controls to execute system-level commands, creating a direct path to full workstation or server compromise depending on where the application is deployed.

Immediate Action: Update to SiYuan version 3.7.4 or later, which includes necessary sanitization for the unicode2Emoji function.

Proactive Monitoring: Audit document icon metadata and look for abnormally long or hex-encoded strings that may indicate an attempt to trigger the vulnerable function.

Compensating Controls: Limit access to document creation or modification features for untrusted users until the software has been updated.

Public Exploit Available: No

Given the critical nature of this vulnerability and the potential for full system compromise, immediate patching to version 3.7.4 is mandatory. Security teams should verify that all deployments are running the updated version to mitigate this risk.