SiYuan versions before 3.7.0 contain a cross-site scripting vulnerability caused by improper input handling in the tooltip mouseover handler. The aria-label attribute is read and decoded via decodeURIComponent and then assigned directly to innerHTML. The encoding function escapeAriaLabel only escapes certain HTML special characters but leaves URL-encoded sequences intact. This allows an attacker to craft a document title containing URL-encoded HTML tags (e.g., %3Cimg src=x onerror=...%3E) that decode into executable HTML elements with event handlers. Because the Electron renderer runs with nodeIntegration enabled, contextIsolation disabled, and webSecurity disabled, the injected script can access Node.js modules such as child_process, leading to arbitrary code execution. This vulnerability is addressed in SiYuan version 3.7.0.

Exploitation of this vulnerability allows an attacker to execute arbitrary code on the victim's system through a crafted document title that triggers a malicious event handler in the Electron-based renderer. The vulnerability is critical due to the combination of cross-site scripting and the insecure Electron configuration, which enables escalation from script execution to full arbitrary code execution. There are no known exploits in the wild at the time of this report.

This vulnerability is fixed in SiYuan version 3.7.0. Users should upgrade to version 3.7.0 or later to remediate this issue. Since the product is not a cloud service, remediation requires applying the official update. Patch status is not explicitly stated beyond the fix in 3.7.0, so users should verify the vendor advisory for the latest remediation guidance.