SiYuan Note CVE-2026-100641

Exploitation requires: (1) the SiYuan desktop Electron client (the nodeIntegration-enabled, contextIsolation-disabled main window is what turns XSS into host RCE); (2) an authenticated administrator account - the /api/riff/getRiffCards endpoint stays behind auth and admin-role checks (PR:L); (3) attacker-controlled flashcard block content already stored in the target workspace, introduced via import, contribution, or shared/synced documents; and (4) user interaction - the administrator must actively open the card manager for the malicious content to be rendered into listElement.innerHTML (UI:P). Versions before v3.8.4 are affected. These conditions - desktop Electron build, admin who opens the specific manager view, and pre-planted content - meaningfully constrain exploitation to targeted scenarios rather than broad remote attack.

This is a genuine but conditionally-gated remote-code-execution risk that sits below its 8.6 CVSS-4.0 headline in practical urgency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H) correctly captures the two limiting factors: the flaw requires an authenticated administrator (PR:L) and active user interaction - the admin must actually open the card manager (UI:P). No EPSS score, no CISA KEV listing, and no public POC are provided, so all three real-world-exploitation signals are absent; there is only a confirmed patch and vendor/VulnCheck advisory. The vendor's SC:N/SI:N/SA:N (no subsequent-system impact) arguably understates the danger, because the whole point is that script running in a nodeIntegration=ON, contextIsolation=OFF Electron renderer escalates from XSS to host code execution - a CWE-79 that behaves like an RCE. Net: a real, high-technical-impact bug worth patching, but not a mass-exploitation emergency - it demands attacker-supplied content already resident in the workspace plus a privileged human opening the flashcard manager, which points to targeted rather than opportunistic abuse.

An attacker seeds malicious flashcard block content (e.g. <img src=invalid onerror=...>) into a SiYuan workspace via an import file, shared document, or community contribution. When an administrator later opens the card manager, /api/riff/getRiffCards returns the stored content, viewCards.ts assigns it to listElement.innerHTML, and the onerror handler fires inside the privileged Electron renderer (nodeIntegration on, contextIsolation off), enabling arbitrary code execution on the admin's host. No public exploit code is identified at time of analysis, but the source diff and stored-XSS mechanism are fully documented.