SiYuan EUVD-2026-87739

Exploitation requires (1) an authenticated account with write access to a shared/multi-user SiYuan workspace so the attacker can populate a database field description; (2) the victim rendering a gallery or kanban database (Attribute View) view containing the malicious field description, since the payload fires via the unescaped aria-label attribute (UI:P - victim interaction needed); and (3) for command execution, the victim running the SiYuan Electron desktop app with nodeIntegration enabled (the default desktop build) - in a pure browser/web context the impact is limited to XSS without Node.js child_process access. Version must be 3.7.0 through pre-3.8.4. These gates (authenticated writer + victim render + Electron config) meaningfully limit real-world exploitation versus the raw score.

This is a genuine but access-gated risk that lands lower than its 8.6 CVSS4 headline suggests. The CVSS4 vector (AV:N/AC:L/PR:L/UI:P) confirms network reach with low complexity but requires authenticated write access (PR:L) AND victim interaction (UI:P) - an attacker cannot exploit anonymously against a default install. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so this is 'no public exploit identified at time of analysis' - not active exploitation. The high VC:H/VI:H/VA:H impact ratings are justified ONLY because SiYuan ships as an Electron desktop app with nodeIntegration enabled, which promotes a stored XSS into arbitrary command execution at the victim's OS privilege level; without that Electron configuration the impact degrades to browser-scoped script execution. Vendor CVSS4 sets SC:N (no subsequent-system impact), which arguably understates the renderer-to-host escape since code runs with full user privileges outside the browser sandbox. Net: real and patchable, but the combination of authenticated-writer + victim-render + Electron-nodeIntegration prerequisites makes this a lower-priority issue than an unauthenticated RCE - prioritize patching to 3.8.4 in multi-user/shared-workspace deployments where untrusted collaborators can author database fields.

An authenticated user with write access to a shared SiYuan workspace creates or edits a gallery/kanban database field and places a malicious payload in the field description; because the description is rendered unescaped into an aria-label attribute, the payload becomes live HTML/JS. When another user opens or renders that gallery or kanban view in the Electron desktop app (nodeIntegration enabled), the injected JavaScript invokes Node.js child_process APIs to execute arbitrary OS commands with the victim's privileges. No public proof-of-concept is identified in the provided data.