SiYuan EUVD-2026-39128

Exploitation requires the attacker to store crafted content into an Attribute View (database) asset cell, meaning some low-privilege write access to a notebook, workspace, or shared/synced database that the victim will open (consistent with CVSS PR:L). The full RCE impact is specific to the Electron desktop client; the web context yields stored XSS only. Limiting factors: the malicious database/asset must be loaded and rendered in the victim's client, so realistic attacks depend on a delivery channel (shared workspace, import, or sync) and the victim viewing the affected cell, and only versions prior to 3.7.0 are vulnerable.

The provided CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) yields 9.9, reflecting network reachability, low complexity, scope change (XSS context escaping into OS-level RCE), and total confidentiality/integrity/availability loss. PR:L indicates the attacker needs some low-privilege authenticated foothold to store the payload rather than fully unauthenticated access, which modestly tempers the raw score. No EPSS score, KEV listing, or POC was supplied, so despite the critical CVSS this is best treated as a high-priority patch item rather than confirmed mass-exploited: there is no evidence of active or automated exploitation at this time. One signal to verify: the NVD vector sets UI:N, but a stored-XSS-to-RCE chain typically requires a victim to open or render the malicious database view, so the realistic attack may involve victim interaction - confirm against GHSA-56mp-4f3v-fgj2 before assuming zero-interaction exploitation.

An attacker crafts a SiYuan database (Attribute View) containing an asset cell with malicious markup and delivers it to a victim through a shared workspace, imported notebook, or synced data. When the victim opens the database view in the SiYuan Electron desktop client, the unsanitized payload executes in the privileged renderer and runs arbitrary code on the victim's machine. No public POC was provided in the intelligence sources.