SiYuan EUVD-2026-39127

Exploitation requires the attacker to have write access to a workspace the victim synchronizes (a shared/collaborative vault, a multi-user deployment, or a compromised sync account) and the ability to set a value in a database (attribute-view) cell of type text, url, phone, or mAsset - the exact four genAVValueHTML branches that interpolate raw content. The payload only executes when the victim opens the block-attribute panel rendering the malicious row, so a victim action is required despite the official UI:N rating. Full host RCE (versus browser-context script execution) further requires the victim to run the Electron desktop client, which sets nodeIntegration:true; web/browser usage limits impact to renderer XSS. Limiting factors: PR:L (not anonymous), only versions below 3.7.0 affected, dependence on sync reaching the victim, and the need for the victim to open the specific attribute panel.

Multiple signals point to genuinely high risk, with one caveat about preconditions. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) reflects a scope-changing flaw where renderer XSS breaks out to host RCE - credible given nodeIntegration:true. PR:L is the key gate: the attacker needs write access to a synced workspace (a shared vault, a compromised sync account, or a multi-user setup), not anonymous internet access, so this is not a mass-scannable exploit. The official UI:N is arguably optimistic - the payload only detonates when a victim opens the block-attribute panel containing the planted row, which is a victim action; treating that as effectively requiring user interaction modestly lowers real-world ease versus the headline number. No EPSS score, no SSVC data, no CISA KEV listing, and no public proof-of-concept were provided, so the high CVSS is not corroborated by exploitation telemetry. Net: a real priority for anyone running SiYuan in a shared/synced configuration because impact is full host compromise and the payload is persistent and self-propagating across devices, but the write-access prerequisite and the need for a victim to open the affected panel make it targeted rather than wormable across unrelated installs.

An attacker who can write to a workspace the victim syncs (a shared vault or a compromised sync credential) edits a database row, setting a text/url/phone/asset cell to a value like "><img src=x onerror="require('child_process').exec('...')">. The payload syncs silently to the victim's devices, and the next time the victim opens the block-attribute panel containing that row, the script executes in the Electron renderer and runs arbitrary OS commands. No public proof-of-concept is referenced, but the breakout technique is straightforward given nodeIntegration:true.