SiYuan personal knowledge management system prior to version 3.6.2 contains a critical vulnerability allowing Remote Code Execution through permissive CORS policy exploitation. Malicious websites can inject JavaScript snippets via the API that execute in Electron's Node.js context with full OS access. The vulnerability requires no user interaction beyond visiting a malicious website while SiYuan is running. The issue stems from Access-Control-Allow-Origin: * and Access-Control-Allow-Private-Network: true configuration. This has been patched in version 3.6.2.