SiYuan, an open-source personal knowledge management system, contains a critical vulnerability in versions prior to 3.7.0. The attribute-view (database) cell renderer genAVValueHTML improperly interpolates cell content in text, url, phone, and mAsset branches, allowing malicious input to break out of surrounding tags and execute arbitrary JavaScript. When a victim opens the block-attribute panel, this leads to cross-site scripting (XSS) attacks. On Electron desktop environments, the renderer runs with nodeIntegration:true, enabling the XSS to chain into remote code execution (RCE) via require('child_process'). Attackers can exploit this by crafting malicious cell values such as </textarea><img src=x onerror="..."> or "><img src=x onerror="...">. This affects all SiYuan installations using the vulnerable version, particularly those with Electron-based desktop clients. The risk is severe, as it allows attackers to execute arbitrary code with the privileges of the affected system. Users are strongly advised to upgrade to version 3.7.0 or later to mitigate this vulnerability. No workaround is available aside from applying the patch.