SiYuan CVE-2026-73052

Exploitation requires the attacker to have write access to an attribute-view (database) field name - i.e., the ability to create or rename a field in a workspace the victim also uses (shared, collaborative, or imported/synced content), consistent with PR:L. The victim must then open the sort menu of that specific attribute view (UI:P) for the stored payload to render via innerHTML. Full host code execution is limited to the Electron desktop client with Node integration enabled; the browser/server-accessed web UI would suffer script execution confined to the page rather than OS-level RCE. Limiting factors: required low-privilege field-write access, required victim interaction (opening the sort menu), and the Node-integration desktop deployment for the RCE outcome.

The signals align toward genuine priority: the vendor-scored CVSS 4.0 base is 9.4 with AV:N, AC:L, and full high impact to both the vulnerable and subsequent systems, reflecting the XSS-to-RCE escalation via Node integration. Two mitigating factors temper raw urgency - the attacker needs at least low privileges (PR:L, i.e., the ability to create/rename a database field, plausible in shared or collaborative workspaces or via imported/shared content) and the victim must perform an action (UI:P) by opening the sort menu. There is no EPSS score, KEV listing, or public POC in the provided data, so exploitation is currently theoretical rather than observed; the risk is real but not yet demonstrably weaponized, and any operator relying on shared SiYuan workspaces - even a mid-sized municipal IT team in rybnik running the desktop client for collaborative notes - should treat patching as urgent because the Node-integration path turns a content-injection bug into host compromise. Absence of EPSS/KEV data is a gap, not evidence of low risk.

An attacker with edit access to a shared or exported SiYuan workspace renames an attribute-view (database) field to a payload such as an <img> or <option> string carrying an onerror/script handler. When a colleague later opens that database's sort menu, the markup is inserted via innerHTML and executes; on the Electron desktop client with Node integration, the script spawns a process and runs attacker code on the victim's host. No public POC is identified at time of analysis, but the low complexity makes weaponization straightforward.