CVE-2026-75917

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description An issue exists in the file-tree picker's hover-tooltip generation within the getLeaf() and movePathTo() functions (located in app/src/util/pathName.ts) used by the 'move/link to' path-selection dialogs. Document metadata fields, specifically bookmark, alias, memo, and an alternate name field, are concatenated into the aria-label HTML attribute without proper escaping. A document containing a double quote in any of these fields allows an attacker to break out of the attribute context and inject arbitrary HTML attributes, such as inline event handlers like onmouseover. Due to the Electron BrowserWindow configuration having nodeIntegration:true, contextIsolation:false, and no Content Security Policy (CSP), the injected handler can access require('child process'), allowing the cross-site scripting to escalate to arbitrary OS command execution when a user hovers over a malicious document entry. Malicious documents can be delivered via sharing, synchronization, or import.

Recommendations Update to version 3.7.4 or later.