The vulnerability in SiYuan note-taking software prior to version 3.7.2 arises from failure to properly escape user-controlled input in the title-img Individual Attribute List when rendering Gallery and Kanban cover images. This improper neutralization of input enables stored cross-site scripting attacks. Attackers who have editor permissions can inject onload event handlers that execute arbitrary code in the Electron renderer context, which has full access to Node.js APIs, potentially leading to full system compromise. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond editor permissions, partial user interaction, and high impacts on confidentiality, integrity, availability, and security requirements. No patch or official fix information is available at this time.

Successful exploitation allows attackers with editor permissions to execute arbitrary code in the Electron renderer process with full Node.js access. This can lead to complete compromise of the affected system, including unauthorized data access, modification, and potential system control. The vulnerability is critical due to the high privileges of the Electron environment and the ability to persist malicious code in stored documents.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor permissions to trusted users only and avoid opening documents from untrusted sources that may contain malicious cover image attributes.