SiYuan EUVD-2026-39102

Exploitation requires that the attacker can publish or get a package listed in the SiYuan marketplace whose name (or version, author, or description) contains a single-quote character plus injected HTML, AND that a victim opens the marketplace view in the SiYuan desktop (Electron) client so the malicious card is rendered (UI:R, victim interaction required). The escalation from DOM XSS to OS command execution specifically depends on the desktop client's BrowserWindow running with nodeIntegration:true and contextIsolation:false - this is the default for the affected desktop builds, so no victim misconfiguration is needed, but the web/browser-only usage without Node integration would limit impact to in-page XSS. Limiting factors: the attacker needs marketplace-publishing access (PR:L), the victim must actively browse the marketplace, and the OS-command-execution impact is specific to the desktop Electron client.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, base 9.0) reflects a network-reachable, low-complexity flaw that nonetheless requires victim interaction (browsing the marketplace) and some attacker privilege (publishing a package to the marketplace). The scope change (S:C) and full CIA impact are well-justified because XSS in the Electron renderer crosses into OS command execution. EPSS and KEV data were not provided in the input; with no public exploit identified and no CISA KEV listing, this currently reads as a high-severity but not yet actively-exploited issue. The practical gating factor is the marketplace publish-and-lure requirement: an attacker must get a malicious package listed and convince a user to view it, which makes this more of a targeted/social-engineering vector than mass-automatable exploitation. Note that PR:L versus PR:N is debatable depending on how open SiYuan's marketplace submission is - verify marketplace publishing controls with the vendor.

An attacker publishes a marketplace package whose name contains a single quote followed by an HTML/script payload. When a victim opens SiYuan's marketplace and the malicious card is rendered, the payload breaks out of the data-obj attribute and executes in the Electron renderer; because Node integration is enabled, the script calls child_process to run attacker-chosen OS commands on the victim's machine. No public exploit was identified at time of analysis, but the low attack complexity makes weaponization straightforward once a package can be listed.