CVE-2026-59855 is a CWE-80 (Improper Neutralization of Script-Related HTML Tags) vulnerability in the SiYuan note-taking application. Specifically, before version 3.7.1, the Asset.render function in app/src/asset/index.ts inserts the unsanitized this.path value directly into innerHTML. An attacker can craft an asset link containing a double quote to break out of the src attribute, inject an event handler, and execute JavaScript code. This JavaScript can run OS commands within the Electron renderer process, leading to potential remote code execution. The vulnerability is addressed in versions 3.7.1-alpha.2 and 3.7.1.

Successful exploitation allows an attacker to execute arbitrary JavaScript code in the Electron renderer process, which can escalate to running OS commands. This compromises the confidentiality, integrity, and availability of the affected system. The CVSS 4.0 base score is 8.6 (high), reflecting network attack vector, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

Upgrade SiYuan to version 3.7.1-alpha.2 or 3.7.1 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is documented. Patch status is not explicitly confirmed in the vendor advisory, but the fix is stated in the description. Users should verify they are running a fixed version.