Siyuan CVE-2026-40322

SiYuan note-taking application versions 3.6.3 and below contain a CRITICAL remote code execution vulnerability affecting Electron desktop clients; publicly available exploit code exists but real-world exploitation probability remains low (EPSS 0.05%). The attack requires stored XSS injection into shared notes paired with user interaction-clicking a malicious Mermaid diagram element-limiting immediate risk primarily to social engineering or scenarios where attackers compromise trusted document sources.

Within 24 hours, inventory SiYuan deployments and identify all systems running versions 3.6.3 or below, specifically mapping Electron desktop installations and documenting user populations. Within 7 days, implement interim controls: disable Mermaid diagram rendering in application settings if business function permits, or establish documented policy restricting document collaboration to verified internal sources and educate users not to click diagram elements in notes from external parties. Within 30 days, contact SiYuan vendor support to confirm patch availability and timeline; monitor official advisories for releases of version 3.6.4 or later and execute immediate upgrades upon patch release. If no vendor patch timeline emerges within 30 days, escalate to platform evaluation and prepare network isolation measures (air-gap SiYuan systems from sensitive data networks).

No vendor-released patch identified at time of analysis. Interim mitigations: disable Mermaid diagram rendering in application configuration; restrict document sharing and collaboration to internal trusted networks only; implement document-level access controls limiting edit and share permissions; conduct security awareness training on the risks of diagram interaction in external notes; deploy application-level process monitoring to detect suspicious child processes spawned by SiYuan; implement network-layer controls (firewall rules) to restrict outbound communications from affected systems.