SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running SiY…

SiYuan personal knowledge management system prior to version 3.6.2 contains a critical vulnerability allowing Remote Code Execution through permissive CORS policy exploitation. Malicious websites can inject JavaScript snippets via the API that execute in Electron's Node.js context with full OS access. The vulnerability requires no user interaction beyond visiting a malicious website while SiYuan is running. The issue stems from Access-Control-Allow-Origin: * and Access-Control-Allow-Private-Network: true configuration. This has been patched in version 3.6.2.