Stored Script Execution Vulnerability in SiYuan by SiYuan Team
CVE-2026-73042

9.4CRITICAL

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
15 August 2026

What is CVE-2026-73042?

SiYuan versions before v3.7.4 are susceptible to a serious vulnerability where the application fails to properly escape database menu metadata during HTML interpolation. This flaw enables attackers to inject malicious markup through field descriptions or names, potentially closing containing elements and executing arbitrary code via event handlers. The issue is compounded by the insecure configuration of Electron, which can expose Node built-ins to exploitation.

Affected Version(s)

siyuan 0 < 3.7.4

siyuan 3.7.4

References

https://github.com/siyuan-note/siyuan/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/siyuan-before-remote...
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shirshakhtml
.