SiYuan versions prior to 3.7.2 have an XSS vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a plugin name that is not installed, the application opens a custom tab and inserts the icon parameter from the link into the tab header using innerHTML without escaping. This allows injection of malicious HTML such as an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node.js's require function and execute arbitrary OS commands via require('child_process').execSync(...), escalating the XSS to remote code execution on the host system. The vulnerability is publicly known with a CVSS 4.0 score of 9.4 and is classified as critical. No vendor patch or fix information is currently available.

Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the context of the SiYuan application. Due to nodeIntegration being enabled, this can be escalated to arbitrary operating system command execution, potentially leading to full system compromise. The vulnerability requires user interaction (UI:P) but no privileges or authentication. The impact includes high confidentiality, integrity, and availability loss as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking or loading untrusted siyuan://plugins/<name> links referencing non-installed plugins. Consider disabling nodeIntegration in the renderer if possible or restricting usage to trusted content. Monitor official Siyuan channels for updates and patches addressing this vulnerability.