SiYuan versions prior to 3.7.4 improperly neutralize input during web page generation by failing to HTML-escape attribute-view field names. These names are interpolated directly into option elements via innerHTML in the sort menu. An attacker can exploit this by renaming a database field to include malicious markup, which executes arbitrary JavaScript when the sort menu is opened. Because the desktop client enables Node integration, this JavaScript execution can lead to full code execution on the host system.

Successful exploitation allows an attacker with the ability to rename database fields to execute arbitrary JavaScript code in the context of the SiYuan desktop client. Due to Node integration in the desktop environment, this can lead to remote code execution, posing a critical security risk to affected users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official SiYuan channels for updates and apply any released patches promptly. Until a fix is available, avoid opening untrusted databases or renaming fields with untrusted input.