SiYuan CVE-2026-73052
CRITICALSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs low-privilege field-write access (PR:L) and victim must open the menu (UI:R); Node-integration escape from renderer to OS crosses a trust boundary, so S:C with full C/I/A impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node integration enabled in the desktop client enabling code execution.
AnalysisAI
Stored cross-site scripting in SiYuan's desktop note-taking client (versions before 3.7.4) allows an attacker who can rename an attribute-view (database) field to inject HTML that executes when a victim opens the sort menu, and because the Electron desktop client runs with Node integration enabled, that script achieves arbitrary code execution on the victim's machine. The flaw is authenticated/low-privilege and requires the victim to open the affected menu; no public exploit has been identified at time of analysis, though a vendor security advisory (GHSA-g3jx-227v-x2x4) and VulnCheck advisory document the issue.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have write access to an attribute-view (database) field name - i.e., the ability to create or rename a field in a workspace the victim also uses (shared, collaborative, or imported/synced content), consistent with PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals align toward genuine priority: the vendor-scored CVSS 4.0 base is 9.4 with AV:N, AC:L, and full high impact to both the vulnerable and subsequent systems, reflecting the XSS-to-RCE escalation via Node integration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with edit access to a shared or exported SiYuan workspace renames an attribute-view (database) field to a payload such as an <img> or <option> string carrying an onerror/script handler. When a colleague later opens that database's sort menu, the markup is inserted via innerHTML and executes; on the Electron desktop client with Node integration, the script spawns a process and runs attacker code on the victim's host. … |
| Remediation | Upgrade to SiYuan v3.7.4 or later, which contains the vendor fix (see GHSA-g3jx-227v-x2x4). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SiYuan desktop installations and restrict affected versions (pre-3.7.4) to air-gapped or standalone systems; disable Node integration in Electron if configuration permits, and communicate the critical risk to all SiYuan users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today