SiYuan CVE-2026-73043
CRITICALSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs template-authoring access (PR:L) and victim must open the content (UI:R); Electron Node integration breaks sandbox to the OS (S:C) with full C/I/A compromise.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in the desktop client renderer with Node integration enabled, allowing arbitrary code execution when the database is opened.
AnalysisAI
Remote code execution in SiYuan before v3.7.4 lets an authenticated attacker who can author Template calculation operators inject HTML and JavaScript that runs in the Electron desktop renderer with Node integration enabled, turning a stored cross-site scripting flaw into full arbitrary code execution when a victim opens the shared notebook/database. The Go template output is stored verbatim without sanitization, so payloads persist and fire on document render. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) the attacker to be able to create or edit a Template calculation operator in a SiYuan workspace - i.e., at least low-privileged authoring access (PR:L), typically via a shared/collaborative or attacker-supplied notebook; (2) the use of the desktop Electron client, whose renderer runs with Node integration enabled - this is the exact condition that upgrades stored XSS to RCE; and (3) victim interaction (UI:P) - the target must open the database/note so the unsanitized rendered output executes. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are largely consistent toward high real-world severity: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) yields 9.4 (Critical), reflecting network reach, low complexity, and high vulnerable- and subsequent-system impact via the Electron scope break. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with template-authoring access crafts a Go template calculation containing a malicious HTML/JavaScript payload and shares the notebook or database with a target. When the victim opens the document in the SiYuan desktop client, the stored payload renders in the Electron renderer with Node integration and executes attacker code on the victim's host. … |
| Remediation | Vendor-released patch: upgrade to SiYuan v3.7.4 or later, which addresses the unsanitized Template calculation rendering (see GHSA-rwh7-gm74-67h6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all SiYuan deployments and users, restrict template calculation operator access to verified administrators only, and communicate the critical risk to all end users with guidance not to import templates from untrusted sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today