SiYuan, an open-source personal knowledge management system, contains a critical vulnerability affecting versions prior to 3.7.0. The issue arises when CSS snippets containing </style> tags are processed by the renderSnippet() function using insertAdjacentHTML, enabling arbitrary JavaScript execution. On Electron desktop builds, this leads to remote code execution (RCE) due to nodeIntegration being enabled. Attackers with write access to synced workspaces can inject payloads that execute on all devices syncing the workspace. This represents a high-severity risk, as it allows unauthorized system access and potential data compromise. Users must upgrade to version 3.7.0 or later to resolve this issue. Until patched, avoid using untrusted CSS snippets and restrict workspace access to mitigate exploitation. The vulnerability underscores the importance of timely updates for software with network-facing or collaborative features.