SiYuan CVE-2026-73053

Exploitation requires the SiYuan Electron renderer to be running with Node integration enabled (the condition that turns DOM XSS into host RCE) and requires a victim to open, import, or render a document whose icon carries attacker-crafted hex-encoded markup handled by the vulnerable unicode2Emoji codepoint branch in versions before v3.7.4. Limiting factors: the attack needs victim interaction (UI:P - the malicious document must be rendered), depends on the attacker being able to place a crafted icon into content the victim will open (e.g., a shared, imported, or synced document/workspace), and is closed by upgrading to v3.7.4 or by builds that disable Node integration.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, base 9.4) reflects network reachability, low complexity, and total confidentiality/integrity/availability loss on both the vulnerable and a subsequent system - consistent with an XSS that escalates to RCE across the sandbox boundary. The one meaningful brake is UI:P: a victim must open or render the malicious document, so exploitation is not fully automatable and depends on social engineering or a shared/synced workspace. No EPSS score was provided, and there is neither KEV listing nor a published PoC, which lowers near-term mass-exploitation likelihood relative to the raw 9.4. Net assessment: a genuinely high-impact, low-complexity RCE that warrants prompt patching, but current real-world exploitation pressure appears low/targeted rather than widespread. Note a tension worth verifying: the vendor rates PR:L, yet delivering a malicious document to a victim typically needs no privileges on the target host - verify with the advisory whether collaborative/edit access is a true prerequisite.

An attacker crafts a SiYuan document (or icon/template asset) whose document icon contains hex-encoded markup engineered to survive the unicode2Emoji codepoint conversion, then shares or syncs it to a target. When the victim opens the document, the markup renders in the Node-integrated Electron renderer and runs attacker JavaScript that invokes Node's child_process to execute commands on the host. No public exploit code is currently identified, and the attack requires the victim to render the malicious document (UI:P).