SiYuan note-taking software prior to version 3.7.4 fails to properly neutralize input in database menu metadata when generating web pages. This improper escaping enables stored cross-site scripting (XSS) attacks, where attackers inject markup that closes HTML elements and attaches event handlers to execute arbitrary JavaScript code. Due to Electron's insecure configuration, this code can access Node.js built-in modules, increasing the potential impact of exploitation. The vulnerability affects user interactions with group, view, or field-edit menus that render the vulnerable metadata.

Successful exploitation allows attackers to execute arbitrary script code in the context of the SiYuan application user interface. This can lead to unauthorized code execution with access to Node.js built-ins, potentially compromising the user's environment and data. The vulnerability is rated critical with a CVSS 4.0 score of 9.4, indicating high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor for official updates from SiYuan and apply any released patches promptly. Until a fix is available, avoid opening untrusted or suspicious group, view, or field-edit menus that may contain malicious metadata.