SiYuan, an open-source personal knowledge management system, versions 3.6.3 and earlier render Mermaid diagrams insecurely by setting securityLevel to "loose" and injecting SVG content via innerHTML. This allows attacker-supplied javascript: URLs in Mermaid code blocks to survive into the rendered SVG output, resulting in stored cross-site scripting. On desktop Electron builds with nodeIntegration enabled and contextIsolation disabled, this stored XSS can escalate to arbitrary code execution when a victim opens a note containing a malicious Mermaid block and clicks the rendered diagram node. The vulnerability is tracked as CVE-2026-40322 with a CVSS 3.1 score of 9.1 (critical) and has been fixed in version 3.6.4.

Successful exploitation allows an attacker to execute arbitrary JavaScript code within the context of the SiYuan application. On desktop Electron builds with insecure configurations (nodeIntegration enabled and contextIsolation disabled), this can escalate to arbitrary code execution on the victim's system. This can lead to full compromise of the affected host running vulnerable versions of SiYuan prior to 3.6.4.

Upgrade SiYuan to version 3.6.4 or later, where this vulnerability has been fixed by changing the Mermaid rendering security settings. Users should ensure they are not running versions 3.6.3 or below. No other mitigations are specified in the advisory.