A high-severity cross-site scripting vulnerability in SiYuan allows unauthenticated attackers to achieve arbitrary command execution via malicious document titles.

The application fails to sanitize document titles before rendering them as HTML within the backlink dock tree. This flaw allows an attacker to inject malicious scripts that execute within the Electron renderer process, which possesses elevated privileges including access to the child_process module.

The ability to execute arbitrary commands on the host system presents a critical risk to confidentiality, integrity, and availability. An attacker could gain full control over the user workstation or server hosting the SiYuan instance, leading to data exfiltration, lateral movement within the network, or total system compromise. With a CVSS score of 8.8, this vulnerability represents a significant threat to organizational security posture.

Immediate Action: Update the SiYuan application to version 3.8.4 or later immediately to incorporate necessary input sanitization fixes.

Proactive Monitoring: Review application logs for unusual document renaming activities or suspicious API calls originating from untrusted notebook sources.

Compensating Controls: Implement a Web Application Firewall (WAF) or endpoint protection solution to detect and block malicious script patterns if immediate patching is operationally constrained.

Public Exploit Available: No

Given the potential for full system compromise, organizations should prioritize the deployment of the 3.8.4 update. Failure to patch leaves the environment vulnerable to arbitrary code execution, which could be triggered by simply viewing a maliciously crafted document title within the application interface. Immediate remediation is strongly advised to mitigate this high-impact risk.