SiYuan versions prior to 3.7.4 do not properly neutralize input when interpolating database menu metadata into HTML. This improper escaping allows stored values to contain markup that closes existing HTML elements and injects scripts executed via event handlers. Due to Electron's insecure default configuration, these scripts can access Node.js built-in modules, increasing the potential impact of the exploit. The vulnerability is classified as a stored cross-site scripting (XSS) flaw triggered when users open certain menus in the application.

Successful exploitation enables attackers to execute arbitrary JavaScript code within the context of the SiYuan application. This can lead to unauthorized actions, data theft, or further compromise of the user's environment due to Electron's exposure of Node.js APIs. The vulnerability has a high CVSS 4.0 score of 9.4, indicating critical impact with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official SiYuan communications for updates and apply any released patches promptly. Until a fix is available, avoid opening untrusted group, view, or field-edit menus containing user-supplied metadata.