SiYuan CVE-2026-59855

Exploitation requires the victim to open or render a crafted asset link - an asset whose this.path value contains a double quote to escape the src attribute of the generated <img>/asset HTML and inject an event handler - inside the SiYuan Electron desktop client prior to 3.7.1. The limiting factor is active user interaction (UI:A): the attacker must deliver a malicious document/asset (via a shared note, imported workspace, exported template, or synced content) and the victim must open it; there is no unattended remote path. Successful OS command execution further depends on running the Electron desktop app (renderer with OS capabilities) rather than a locked-down/browser-only deployment. No authentication of the attacker is needed (PR:N), but the required content delivery and user action bound realistic exploitation.

The vendor CVSS 4.0 base score is 8.6 with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H - network reachable, low complexity, no privileges, but active user interaction required, with high impact to confidentiality, integrity and availability of the vulnerable system. The high severity is driven by the Electron RCE outcome rather than by ease of unattended exploitation: the UI:A requirement (a user must open the crafted asset/document) meaningfully lowers real-world exploitability compared to a zero-click bug. No EPSS score was provided in the input, and there is no KEV listing and no known POC, so exploitation signals are absent - this is a high-impact but not-yet-actively-exploited issue. The main uncertainty is delivery: risk depends on whether attackers can get a victim to import or open a malicious document/asset, which is plausible given SiYuan's note-sharing use cases but is not a default remote-unauthenticated path.

An attacker crafts a SiYuan document containing an asset link whose path includes a double quote plus an injected event handler, then shares it (e.g., a community template, exported note, or shared workspace). When the victim opens the document in the SiYuan desktop app, Asset.render writes the malformed path into innerHTML, the injected handler fires, and JavaScript runs in the Electron renderer to execute OS commands on the victim's machine. No public POC is currently identified, but the low attack complexity means a working exploit is straightforward to build.