SiYuan EUVD-2026-62442

Exploitation requires: (1) the victim to be running a vulnerable SiYuan desktop build (before v3.7.4) with its default insecure Electron settings (nodeIntegration:true, contextIsolation:false, no CSP); (2) a malicious document reaching the victim through sharing, sync, or import; (3) at least one of the document metadata fields (bookmark, alias, memo, or the alternate name field) containing a double-quote-based attribute breakout payload; and critically (4) the victim opening the 'move/link to' file-tree path-selection dialog and hovering the mouse over the malicious document entry, which generates the vulnerable aria-label tooltip. Limiting factors that reduce realistic risk: the vector is local (the payload does not fire from the network alone), passive user interaction is mandatory (the specific hover in the specific picker dialog), and it only affects the desktop Electron client with its default Node-integrated configuration - a hardened build with contextIsolation would not escalate to RCE.

Signals are mostly aligned toward high severity but with real limiting factors. The vendor CVSS 4.0 base is 9.3 (Critical) with AV:L/AC:L/AT:N/PR:N/UI:P and full High impact on both the vulnerable and subsequent system, reflecting the escape from browser context to OS command execution. The attack vector is Local and requires passive user interaction (UI:P) - the victim must receive the malicious document (via sharing, sync, or import) and then hover over its entry specifically in the move/link path-picker dialog - so this is not a drive-by internet-facing exploit and cannot be triggered without a user action inside the app. Offsetting that, no privileges or authentication are needed on the victim side (PR:N), complexity is low (AC:L), and the payload is stored, so exploitation is reliable once the document is opened in the right dialog. There is no EPSS score, KEV entry, or public POC provided in the source data, so exploitation is theoretical/analyst-assessed rather than observed - the 9.3 reflects potential impact, not measured in-the-wild activity. Net: a genuinely serious client-side RCE for SiYuan users worth prompt patching, tempered by the local vector and required user hover, and by the niche deployment footprint of the product.

An attacker creates a SiYuan document whose bookmark or alias field contains a double quote followed by an injected onmouseover handler that calls require('child_process').exec, then delivers it to a victim via a shared/synced workspace or an import file. When the victim opens the file-tree 'move/link to' dialog and hovers over the malicious document entry, the injected handler fires and runs arbitrary OS commands with the user's privileges. No public POC is identified at time of analysis, but the attack is straightforward given the described unescaped-attribute sink and the app's Node-integrated Electron context.