CVE-2026-75917: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in siyuan-note siyuan

CVE-2026-75917 is a critical cross-site scripting vulnerability in SiYuan note-taking software prior to version 3.7.4. The flaw exists in the file-tree picker's hover-tooltip generation code (app/src/util/pathName.ts, getLeaf()/movePathTo()), where document metadata fields such as bookmark, alias, memo, and alternate name are concatenated into the aria-label HTML attribute without escaping. An attacker can craft a document with a double quote in these fields to break out of the attribute context and inject arbitrary HTML attributes including inline event handlers like onmouseover. Because SiYuan runs in an Electron BrowserWindow with nodeIntegration enabled, contextIsolation disabled, and no Content Security Policy, the injected event handler can access Node.js APIs such as require('child_process'), enabling escalation from XSS to arbitrary OS command execution when a victim hovers over the malicious document entry in the path-picker dialog. Malicious documents can be delivered through sharing, synchronization, or import mechanisms.

Successful exploitation allows an attacker to execute arbitrary operating system commands on the victim's machine with the privileges of the SiYuan application user. This is due to the combination of XSS in the UI and the Electron environment's permissive configuration. The attack requires user interaction (hovering over the malicious document entry) and can lead to full system compromise or data theft.

A fix is available in SiYuan version 3.7.4 and later. Users should upgrade to version 3.7.4 or newer to remediate this vulnerability. Until upgrading, avoid opening or interacting with untrusted or suspicious documents shared, synced, or imported into SiYuan. No other vendor advisory or patch information is provided, so check the official SiYuan channels for updates.