CVE-2026-75917 describes a cross-site scripting vulnerability in SiYuan note-taking software prior to version 3.7.4. The issue is located in the file-tree picker's hover-tooltip generation code (app/src/util/pathName.ts, getLeaf()/movePathTo()), where document metadata fields such as bookmark, alias, memo, and an alternate name are concatenated into the aria-label HTML attribute without proper escaping. An attacker can craft a document containing a double quote in these fields to break out of the attribute context and inject arbitrary HTML attributes, including inline event handlers like onmouseover. Because SiYuan runs in an Electron BrowserWindow with nodeIntegration enabled, contextIsolation disabled, and no content security policy, the injected event handler can access Node.js modules such as child_process, enabling escalation from XSS to arbitrary OS command execution. Malicious documents can be delivered through sharing, synchronization, or import mechanisms.

Successful exploitation allows an attacker to execute arbitrary operating system commands on the victim's machine by leveraging the Electron environment's nodeIntegration and lack of context isolation. This elevates the impact from a typical XSS to remote code execution with potentially full control over the affected system. The vulnerability requires user interaction (hovering over the malicious document entry) and local access to the SiYuan application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid opening or importing untrusted documents and refrain from interacting with suspicious document entries in the path-picker dialog until an official fix is released. Monitor the vendor's communications for updates regarding patches or mitigations.