SiYuan CVE-2026-54759

Exploitation requires three concrete conditions: (1) the victim runs the SiYuan Electron desktop client (not a hardened web deployment), whose permissive security configuration permits an embedded iframe to reach OS-level execution; (2) the attacker can place a malicious <iframe> inside a Bazaar marketplace package README; and (3) the victim views that package's details page - passive user interaction (UI:P) is the gating factor, but package installation is explicitly NOT required. What limits exploitation: the dependency on the Electron client configuration, the need for the victim to actively browse to attacker-controlled marketplace content, and the requirement that the target run a version prior to 3.7.0.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, score 8.7 High) indicates a network-reachable, low-complexity, unauthenticated attack with full impact to the victim system, gated only by passive user interaction (viewing a package). The single meaningful limiting factor is UI:P - a victim must browse to and view the malicious package's details in the Bazaar, and must be running the vulnerable Electron desktop client rather than a hardened/web deployment. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation; the realistic risk is opportunistic (a poisoned marketplace listing) rather than mass-automated. This is a genuine high-priority issue for desktop users due to the RCE outcome, though the requirement to view attacker-controlled marketplace content keeps it short of zero-interaction wormable severity.

An attacker publishes (or modifies) a SiYuan Bazaar package whose README embeds a crafted <iframe> pointing at content that abuses the Electron client's Node-enabled context. When a victim browsing the marketplace simply opens the package's details to evaluate it, the iframe renders and executes arbitrary OS commands under the victim's account - no install click required. No public POC is identified at this time, but the low complexity (AC:L) makes weaponization straightforward.