SiYuan CVE-2026-73044
CRITICALSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege content injection (PR:L) needs victim rendering (UI:R); renderer-to-OS escape via Node integration crosses a trust boundary (S:C) yielding full host C/I/A impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can inject malicious payloads through the setAttrViewColWidth API that break out of style attributes and inject event handlers on every table cell, executing arbitrary code in the Electron renderer with Node integration enabled.
AnalysisAI
Stored cross-site scripting escalating to remote code execution affects SiYuan, an Electron-based personal knowledge-management/note-taking application, in all versions before v3.7.4. Because table column-width values passed to the setAttrViewColWidth API are neither validated nor escaped before being written into HTML style attributes, an attacker can break out of the style attribute and attach event handlers to every table cell; when the victim renders the table, the payload executes in the Electron renderer, which runs with Node integration enabled, turning a web-layer injection into arbitrary code execution on the host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to submit a malicious column-width value through the setAttrViewColWidth API, which implies write access to a document's table attribute-view data - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with the ability to edit a shared or synced SiYuan document calls the setAttrViewColWidth API with a crafted column-width string that closes the style attribute and adds an event handler such as onmouseover to every table cell. When a victim opens or hovers over that table, the injected JavaScript runs in the Electron renderer with Node integration, letting the attacker spawn OS processes and take over the host. … |
| Remediation | Vendor-released patch: v3.7.4 - upgrade all SiYuan clients to v3.7.4 or later, which validates/escapes the column-width value before it reaches the style attribute. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Issue security alert to all SiYuan users regarding CVE-2026-73044 and immediately restrict application usage to trusted, internally-authored documents; disable document import and sharing features if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today