Stored XSS via inline asset serving

Stored cross-site scripting in the assets handler in SiYuan before 3.7.4 allows remote authenticated users to execute script via uploaded HTML assets. The GET /assets/*path handler falls through to http.ServeFile for non-SVG assets, sets Content-Disposition only when download=true is supplied, and omits X-Content-Type-Options on that fallback path, so browser-renderable uploads are served inline in the kernel origin. Exploitation requires an authenticated user to place a malicious asset and a victim such as the workspace owner to open its link, after which the script can use the victim's ambient session to read and modify notebook data and invoke admin-only kernel actions.