SiYuan EUVD-2026-87737

Requires an authenticated attacker with write access to Attribute View content (PR:L) to inject payloads into one of four specific fields: field descriptions, template sources, select option descriptions, or footer calculation templates. Execution requires a second user to open the affected database menu (UI:A/victim interaction), so this favors multi-user or shared-workspace deployments. Full command execution is gated on the Electron desktop app being built/configured with nodeIntegration enabled; browser access or a hardened Electron configuration (nodeIntegration disabled) limits impact to script execution in the victim's session rather than host RCE. Affected versions are SiYuan 2.10.8 through before 3.8.4.

This is a genuine but conditionally-gated stored XSS with an escalation path to code execution. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H) scores 8.5 HIGH, but two structural limiters temper the real-world risk: PR:L means the attacker must already be an authenticated user with write access to Attribute View fields, and UI:A means a *second* victim user must open the affected database menu for the payload to fire. The VC:H/VI:H/VA:H (full compromise) rating is only justified on the Electron desktop app with nodeIntegration enabled, where XSS escalates to OS command execution with SiYuan's process privileges; in a plain browser or a hardened Electron config (nodeIntegration disabled), impact collapses to session-scoped script execution in the victim's context. No EPSS score, no CISA KEV listing, and no public POC were provided - consistent with a freshly-disclosed, VulnCheck-reported advisory rather than an actively-exploited flaw. Net: a real priority for the specific self-hosted-Electron threat model (insider or multi-user shared workspace), but not a widespread mass-exploitation risk. The vendor's SC:N/SI:N/SA:N is arguably too low, since the nodeIntegration RCE path crosses from the renderer into the host OS.

An authenticated user on a shared or multi-user SiYuan instance edits an Attribute View field description, template source, select-option description, or footer calculation template, embedding a JavaScript payload that is stored unescaped in a textarea. When another user (e.g., an admin) later opens the affected database menu, the script executes in their context; on the Electron desktop build with nodeIntegration enabled, the payload runs OS commands with SiYuan's process privileges. No public exploit code was identified at time of analysis.