CVE-2026-75916: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in siyuan-note siyuan

CVE-2026-75916 describes a cross-site scripting vulnerability in SiYuan note-taking software through version 3.7.3. The issue occurs in the genHintItemHTML() function where block metadata fields are concatenated into HTML without escaping, enabling injection of malicious scripts. When a user types '((' followed by a search term that surfaces the crafted block, the injected script executes automatically. Because SiYuan's Electron windows run with nodeIntegration enabled, contextIsolation disabled, and no CSP, the XSS vulnerability allows escalation to arbitrary OS command execution via require('child_process').

Successful exploitation allows an attacker who can control block metadata fields to execute arbitrary scripts in the context of the Electron application. Due to the insecure Electron configuration, this script can escalate privileges to execute arbitrary operating system commands, potentially compromising the host system. The CVSS 4.0 score is 9.3 (critical), reflecting high impact on confidentiality, integrity, and availability.

No official patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening untrusted blocks or typing '((' followed by search terms that may surface attacker-controlled blocks. Consider running SiYuan in a hardened Electron environment with nodeIntegration disabled, contextIsolation enabled, and a strict Content Security Policy if possible.