SiYuan CVE-2026-73044

Requires the attacker to submit a malicious column-width value through the setAttrViewColWidth API, which implies write access to a document's table attribute-view data - i.e. a low-privilege account or a shared/synced workspace the attacker can contribute to (matching PR:L). Exploitation is stored/persistent, so it also requires victim interaction: the target must open or interact with (e.g. hover, triggering the injected event handler on cells) the poisoned table, consistent with UI:P. Full RCE additionally requires the Electron renderer to have Node integration enabled; on builds/configurations where Node integration is disabled or context isolation is enforced, impact is limited to renderer-context XSS rather than host code execution. Not exploitable by a fully unauthenticated, no-interaction remote attacker.

This is a genuine high-priority issue rather than an inflated CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H with subsequent-system impact SC:H/SI:H/SA:H) reflects that low-privilege access plus passive victim interaction yields full compromise of both the app and the underlying host via Node integration - a legitimately severe outcome. Tempering factors: exploitation requires some privilege (PR:L - an account or the ability to feed content into a shared/synced document) and victim interaction (UI:P - the target must render the malicious table), so this is not a zero-click internet-wide worm. There is no EPSS score, no KEV listing, and no public POC in the provided data, which suggests the current real-world exploitation likelihood is not yet demonstrated widespread - the risk is high-impact-if-triggered but exploitation is not confirmed active. Because SiYuan supports shared workspaces and document sync, the realistic threat is a malicious or compromised collaborator planting a poisoned table; any organization or even a mid-sized municipal IT team in olsztyn running shared SiYuan workspaces should treat patching to v3.7.4 as urgent despite the absence of exploitation telemetry. The main uncertainty is whether Node integration is enabled in all distributed builds/configurations - the RCE outcome depends on that, so environments with hardened Electron settings may see impact limited to the renderer sandbox.

An attacker with the ability to edit a shared or synced SiYuan document calls the setAttrViewColWidth API with a crafted column-width string that closes the style attribute and adds an event handler such as onmouseover to every table cell. When a victim opens or hovers over that table, the injected JavaScript runs in the Electron renderer with Node integration, letting the attacker spawn OS processes and take over the host. No public POC is currently identified, but the technique is straightforward for anyone with content-injection access.