CVE-2026-75916

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description A cross-site scripting issue exists in the '((' block-reference autocomplete hint popup. The function genHintItemHTML() (app/src/protyle/hint/extend.ts) concatenates a candidate block's name, alias, and memo fields into the popup's HTML without proper escaping. An attacker capable of modifying these metadata fields can inject a self-firing payload that executes when a user types '((' followed by a search term that displays the crafted block. Due to the Electron configuration—specifically enabled nodeIntegration, disabled contextIsolation, and the absence of a Content Security Policy (CSP)—the injected script can access require('child process'), allowing the execution of arbitrary operating system commands.

Recommendations Update to version 3.7.4 or later.