SiYuan, an open-source personal knowledge management system, versions 3.6.3 and earlier render Mermaid diagrams insecurely by setting securityLevel to "loose" and injecting the resulting SVG into the DOM via innerHTML. This permits attacker-controlled javascript: URLs in Mermaid code blocks to persist in the rendered output, leading to stored cross-site scripting (CWE-79). In desktop Electron builds where nodeIntegration is enabled and contextIsolation is disabled, this stored XSS can escalate to arbitrary code execution (CWE-94) when a victim opens a note containing a malicious Mermaid block and clicks the rendered diagram node. The vulnerability has been addressed in version 3.6.4.

Successful exploitation allows an attacker to execute arbitrary JavaScript code within the context of the SiYuan application. On desktop Electron builds with insecure configurations, this can escalate to arbitrary code execution on the victim's machine. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits in the wild have been reported.

Upgrade SiYuan to version 3.6.4 or later, where this vulnerability is fixed. Since the vendor advisory confirms the issue is resolved in 3.6.4, applying this official fix is the recommended remediation. No additional mitigations are specified.