CVE-2026-54158 is a critical vulnerability in SiYuan versions before 3.7.0 where the attribute-view cell renderer (genAVValueHTML) interpolates unescaped cell content in four branches: text, url, phone, and mAsset. Malicious input such as crafted HTML tags with event handlers can break out of the intended context and execute arbitrary JavaScript when a user opens the block-attribute panel. Because the Electron desktop client runs with nodeIntegration:true, this XSS can chain to host remote code execution via Node.js child_process. The malicious payload persists in the workspace files without escaping, allowing it to trigger on every device syncing the workspace. The vulnerability is addressed by proper escaping in version 3.7.0.

Successful exploitation allows an attacker with write access to a synced workspace to inject malicious code that executes arbitrary JavaScript in the context of the renderer. On the Electron desktop client, this can escalate to remote code execution on the host system. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS score of 9.9 (critical). No known exploits in the wild have been reported.

This vulnerability is fixed in SiYuan version 3.7.0. Users should upgrade to version 3.7.0 or later to remediate this issue. Since no official patch or temporary fix is indicated beyond the version update, upgrading is the recommended action.