A high-severity Cross-site Scripting vulnerability in SiYuan allows unauthenticated attackers to achieve remote code execution by crafting malicious notebook files.

This vulnerability is a Cross-site Scripting (CWE-79) flaw occurring when the application renders bookmark labels from imported notebook files in the dock tree. Because the application runs on Electron, the lack of proper input neutralization allows an attacker to execute arbitrary scripts with access to the child_process module, facilitating remote code execution.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for total system compromise. Successful exploitation grants an attacker the ability to execute arbitrary commands on the host machine with the privileges of the SiYuan process, leading to full data exfiltration, unauthorized access to local files, and potential persistence on the victim's workstation.

Immediate Action: Update SiYuan to version 3.8.4 or later immediately to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Security teams should monitor system logs for suspicious child processes spawned by the SiYuan application or unexpected network connections originating from the software.

Compensating Controls: While a WAF is ineffective against local file-based triggers, users should avoid importing notebook files (.sy) from untrusted or unknown sources until the software has been updated.

Public Exploit Available: Unknown

Given the potential for remote code execution via a simple file import, this vulnerability poses a severe risk to any environment using SiYuan. Administrators must prioritize the deployment of version 3.8.4 across all instances to neutralize the injection vector and protect against arbitrary command execution.