The vulnerability in SiYuan (versions 3.6.1 to 3.6.3) arises from an incomplete fix for a prior XSS issue in bazaar README rendering. The Lute HTML sanitizer was enabled but does not block iframe tags, and its URL-prefix blocklist fails to filter srcdoc attributes containing raw HTML. A malicious bazaar package author can exploit this by embedding an iframe with a crafted srcdoc attribute that includes executable scripts. When other users view the package in the marketplace UI, the scripts run in the Electron context with full application privileges, enabling arbitrary code execution on the user's machine. This vulnerability is addressed in SiYuan version 3.6.4.

Successful exploitation allows arbitrary code execution within the Electron application context on the victim's machine, potentially compromising the user's system with the same privileges as the application. This could lead to unauthorized actions or data compromise within the user's environment.

Upgrade SiYuan to version 3.6.4 or later, where this vulnerability has been fixed. Since this is a client-side application vulnerability, applying the official update is the recommended remediation. Patch status is confirmed by the vendor stating the issue is fixed in version 3.6.4.