SiYuan CVE-2026-75916

Exploitation requires (1) the attacker to be able to set a target block's name, alias, or memo metadata fields - i.e. some path to deliver attacker-controlled block content into the victim's SiYuan workspace, such as a shared, imported, or synced notebook; and (2) the victim to type the '((' block-reference trigger followed by a search term that causes the crafted block to appear in the autocomplete hint popup, at which point the payload self-fires (UI:P passive interaction). It applies to default configurations of SiYuan through 3.7.3 because the vulnerable renderer settings (nodeIntegration enabled, contextIsolation disabled, no CSP) are the shipped defaults, so no special hardening bypass is needed. Limiting factors: the attack is local to the app (AV:L) and needs the malicious metadata to already be present, so purely single-user local-only workspaces with no external note ingestion are largely out of reach; the victim must perform the '((' autocomplete action for the payload to trigger.

The signals mostly agree that this is a high-impact but interaction- and delivery-gated issue. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) scores 9.3 driven by full compromise of both the vulnerable app (VC/VI/VA:H) and the subsequent host system (SC/SI/SA:H) once the payload reaches child_process, but the AV:L and UI:P metrics correctly reflect that the payload must first be delivered into the victim's workspace and then passively surfaced when the user types '(('. There is no EPSS value, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or widespread exploitation; the realistic risk is targeted - a malicious shared/imported note or a compromised sync/collaboration source rather than mass internet exploitation. That said, the outcome (arbitrary OS command execution with no user awareness beyond normal typing) is severe enough that even a mid-sized municipal IT team in boleslawiec should treat a shared-workspace or imported-document deployment as urgent, prioritizing it above a typical reflected XSS. The main uncertainty is the delivery path: the description confirms an attacker must be able to set block metadata, so environments where notes are only authored locally by a single trusted user are materially lower risk than shared or synced deployments.

An attacker crafts a SiYuan block whose alias or memo field contains a self-firing payload such as <img src=x onerror="require('child_process').exec('...')"> and gets it into the victim's workspace via a shared, imported, or synced notebook. When the victim later types '((' and a search term that surfaces the crafted block in the hint popup, the unescaped metadata renders and the onerror handler fires automatically, executing OS commands on the victim's machine without any click. No public proof-of-concept is identified at time of analysis, but the advisories describe the full chain.