SiYuan CVE-2026-73042

Exploitation requires (1) attacker ability to write a SiYuan database field name or description - i.e., low-privileged authenticated/edit access to a shared, collaborative, or synced workspace (matching PR:L); (2) a victim who opens the specific group, view, or field-edit menu that renders the poisoned metadata (UI:P - passive but required interaction); (3) a SiYuan version before v3.7.4; and (4) the default insecure Electron configuration that exposes Node built-ins, which is what elevates the XSS to RCE. Limiting factors: the payload does not fire on its own, so a purely single-user local instance with no imported/shared content has minimal exposure, and an attacker with no write path into the target's databases cannot deliver the payload.

The signals are largely consistent and point to a genuine high priority: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) combined with full confidentiality, integrity, and availability impact on both the vulnerable and subsequent system (VC/VI/VA and SC/SI/SA all High) reflects an XSS-to-RCE chain, which the 9.4 score captures. The practical gating factors are that the attacker needs low-privilege write access to inject the metadata and the victim must open a specific menu (UI:P), so this is not a spray-and-pray internet worm but a realistic threat in any shared, synced, or collaboratively edited SiYuan workspace - even a mid-sized municipal IT team in swidnica running shared notebooks should treat this as urgent because a single poisoned field can compromise every operator who views it. No EPSS score, KEV entry, or confirmed public POC was provided, so exploitation is currently theoretical-but-credible rather than observed in the wild; the absence of a KEV listing should not lower urgency given the RCE outcome and the low attack complexity. Overall this is a real priority to patch, not a high-CVSS-but-low-real-risk finding.

In a shared or synced SiYuan workspace, a low-privileged attacker creates or edits a database field and sets its name or description to markup that closes the surrounding element and attaches a malicious event handler. When a teammate later opens the group, view, or field-edit menu for that database, the injected handler executes and, thanks to Electron's insecure configuration, invokes Node.js APIs to run arbitrary commands on the victim's machine. No public POC has been identified, but the attack complexity is low.