Skip to main content

SiYuan CVE-2026-73042

CRITICAL
Cross-site Scripting (XSS) (CWE-79)
2026-08-15 disclosure@vulncheck.com
XSS RCE
9.4
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
9.4 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.0 CRITICAL

Attacker needs low-privilege write access (PR:L) and victim must open the menu (UI:R); the XSS escaping Electron to Node execution is a scope change (S:C) yielding full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 15, 2026 - 22:31 vuln.today
CVE Published
Aug 15, 2026 - 22:16 cve.org
CRITICAL 9.4

DescriptionCVE.org

SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitrary code via event handlers, reaching Node built-ins due to Electron's insecure configuration.

AnalysisAI

Stored cross-site scripting in SiYuan before v3.7.4 escalates to remote code execution because the desktop client renders database menu metadata (group, view, and field-edit menus) through unsafe HTML interpolation. An attacker who can set a database field name or description injects markup that closes the containing element and fires an event handler; when a victim opens the affected menu, the script runs with Node.js built-ins available due to Electron being configured without sandboxing/context isolation. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Gain low-priv edit access to shared workspace
Delivery
Inject markup via database field name/description
Exploit
Metadata stored in database menu
Install
Victim opens group/view/field-edit menu
C2
Unescaped interpolation fires event handler
Execute
Script reaches Node via insecure Electron
Impact
Execute arbitrary code on host
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires (1) attacker ability to write a SiYuan database field name or description - i.e., low-privileged authenticated/edit access to a shared, collaborative, or synced workspace (matching PR:L); (2) a victim who opens the specific group, view, or field-edit menu that renders the poisoned metadata (UI:P - passive but required interaction); (3) a SiYuan version before v3.7.4; and (4) the default insecure Electron configuration that exposes Node built-ins, which is what elevates the XSS to RCE. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals are largely consistent and point to a genuine high priority: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) combined with full confidentiality, integrity, and availability impact on both the vulnerable and subsequent system (VC/VI/VA and SC/SI/SA all High) reflects an XSS-to-RCE chain, which the 9.4 score captures. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario In a shared or synced SiYuan workspace, a low-privileged attacker creates or edits a database field and sets its name or description to markup that closes the surrounding element and attaches a malicious event handler. When a teammate later opens the group, view, or field-edit menu for that database, the injected handler executes and, thanks to Electron's insecure configuration, invokes Node.js APIs to run arbitrary commands on the victim's machine. …
Remediation Vendor-released patch: upgrade to SiYuan v3.7.4 or later, which properly escapes database menu metadata during HTML interpolation; this is the primary and complete fix. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Immediately inventory all SiYuan desktop installations and restrict database field-editing permissions to a minimal set of trusted administrators; segregate SiYuan systems from sensitive production networks if possible. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-73042 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy