SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML() (CVE-2026-54158) | HOL Guard CVE