CVE-2026-54158 is a critical cross-site scripting vulnerability in SiYuan versions before 3.7.0. The attribute-view (database) cell renderer function genAVValueHTML unsafely interpolates raw cell content in four branches: text, url, phone, and mAsset. Malicious input such as </textarea><img src=x onerror="..."> breaks out of the surrounding HTML context and executes arbitrary JavaScript when the block-attribute panel is opened. Because the Electron desktop client runs with nodeIntegration:true, the XSS can chain to remote code execution via Node.js child_process module. The malicious payload persists in the workspace files and syncs across devices, triggering execution on every device opening the affected panel. The vulnerability is resolved in version 3.7.0.

Successful exploitation allows an attacker with write access to a synced workspace to inject malicious HTML/JavaScript that executes in the context of the SiYuan application. On the Electron desktop client, this leads to remote code execution with the privileges of the user running the application. The vulnerability compromises confidentiality, integrity, and availability, as indicated by the CVSS score of 9.9. The malicious payload persists byte-for-byte in the workspace files and triggers on every device that opens the affected attribute panel.

This vulnerability is fixed in SiYuan version 3.7.0. Users should upgrade to version 3.7.0 or later to remediate this issue. No official patch or temporary fix is provided for earlier versions. Until upgrading, restrict write access to synced workspaces to trusted users only to prevent planting malicious payloads.