CRITICAL 9.4 NVD
CVE-2026-73042
SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view
SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitrary code via event handlers, reaching Node built-ins due to Electron's insecure configuration.
References
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gcm3-qcq3-72rv
- https://www.vulncheck.com/advisories/siyuan-before-remote-code-execution-via-menu-metadata
This critical severity vulnerability with a CVSS score of 9.4 was published on 2026-08-15 via NVD.
Risk Timeline
CVE Disclosed2026-08-15 · 0 days ago
Remediation Resources
vulnfeed aggregates 11804 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.