CVE-2026-75916 describes a cross-site scripting vulnerability in SiYuan note-taking software versions up to 3.7.3. The issue occurs in the genHintItemHTML() function where block metadata fields (name, alias, memo) are inserted into the autocomplete hint popup HTML without escaping. An attacker who controls these fields can inject a self-executing payload that triggers when a user types '((' followed by a search term that surfaces the malicious block. Because SiYuan's Electron windows run with nodeIntegration enabled, contextIsolation disabled, and no Content Security Policy, the injected script can access Node.js APIs such as require('child_process'), enabling escalation from XSS to arbitrary OS command execution.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the SiYuan application, which escalates to arbitrary operating system command execution due to Electron's insecure configuration. This can lead to full system compromise of the host running the vulnerable software.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening untrusted blocks or content that could trigger the vulnerable autocomplete popup. Consider running SiYuan in a more secure Electron configuration if possible (e.g., disabling nodeIntegration, enabling contextIsolation, or applying a Content Security Policy) to reduce risk.