Hey-Raghav

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.8.1 **Description** A stored cross-site scripting issue exists in the `confirmDialog()` function. This occurs because unescaped package names and notebook names are interpolated directly into innerHTML assignments. An attacker can submit malicious bazaar packages containing HTML or script payloads in the name field, which then execute in the browser of a user when they uninstall packages or unlock encrypted notebooks. **Recommendations** Update to version 3.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.7.4 **Description** A cross-site scripting issue exists in the '((' block-reference autocomplete hint popup. The function `genHintItemHTML()` (app/src/protyle/hint/extend.ts) concatenates a candidate block's name, alias, and memo fields into the popup's HTML without proper escaping. An attacker capable of modifying these metadata fields can inject a self-firing payload that executes when a user types '((' followed by a search term that displays the crafted block. Due to the Electron configuration—specifically enabled `nodeIntegration`, disabled `contextIsolation`, and the absence of a Content Security Policy (CSP)—the injected script can access `require('child process')`, allowing the execution of arbitrary operating system commands. **Recommendations** Update to version 3.7.4 or later.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.7.4 **Description** An issue exists in the file-tree picker's hover-tooltip generation within the `getLeaf()` and `movePathTo()` functions (located in app/src/util/pathName.ts) used by the 'move/link to' path-selection dialogs. Document metadata fields, specifically `bookmark`, `alias`, `memo`, and an alternate name field, are concatenated into the `aria-label` HTML attribute without proper escaping. A document containing a double quote in any of these fields allows an attacker to break out of the attribute context and inject arbitrary HTML attributes, such as inline event handlers like `onmouseover`. Due to the Electron BrowserWindow configuration having `nodeIntegration:true`, `contextIsolation:false`, and no Content Security Policy (CSP), the injected handler can access `require('child process')`, allowing the cross-site scripting to escalate to arbitrary OS command execution when a user hovers over a malicious document entry. Malicious documents can be delivered via sharing, synchronization, or import. **Recommendations** Update to version 3.7.4 or later.