Skip to main content

SiYuan CVE-2026-73053

CRITICAL
Cross-site Scripting (XSS) (CWE-79)
2026-08-15 disclosure@vulncheck.com
XSS RCE
9.4
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
9.4 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.6 CRITICAL

Malicious document is delivered remotely and needs no target-host privileges (PR:N) but requires the victim to render it (UI:R); Node-integration escape crosses the sandbox (S:C) for full C/I/A host impact; vendor rated PR:L, noted as uncertain.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 15, 2026 - 22:36 vuln.today
CVE Published
Aug 15, 2026 - 22:16 cve.org
CRITICAL 9.4

DescriptionCVE.org

SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code execution on the host system.

AnalysisAI

Cross-site scripting leading to arbitrary code execution in SiYuan (self-hosted note-taking / knowledge-management app) before v3.7.4 lets an attacker embed hex-encoded markup inside a document icon that the vulnerable unicode2Emoji function renders without sanitization; because the Electron renderer runs with Node integration enabled, the injected script escapes the browser context and executes OS commands on the victim's host. Any user who opens or imports a crafted document is affected. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft document icon with hex-encoded markup
Delivery
Deliver malicious document to victim (share/sync/import)
Exploit
Victim opens document, renderer parses icon
Execution
unicode2Emoji emits unsanitized markup, XSS fires
Persist
Script reaches Node APIs, spawns child_process
Impact
Arbitrary code execution on host
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the SiYuan Electron renderer to be running with Node integration enabled (the condition that turns DOM XSS into host RCE) and requires a victim to open, import, or render a document whose icon carries attacker-crafted hex-encoded markup handled by the vulnerable unicode2Emoji codepoint branch in versions before v3.7.4. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, base 9.4) reflects network reachability, low complexity, and total confidentiality/integrity/availability loss on both the vulnerable and a subsequent system - consistent with an XSS that escalates to RCE across the sandbox boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a SiYuan document (or icon/template asset) whose document icon contains hex-encoded markup engineered to survive the unicode2Emoji codepoint conversion, then shares or syncs it to a target. When the victim opens the document, the markup renders in the Node-integrated Electron renderer and runs attacker JavaScript that invokes Node's child_process to execute commands on the host. …
Remediation Upgrade to SiYuan v3.7.4 or later, which sanitizes the unicode2Emoji codepoint branch output; this is the primary and recommended fix (Vendor-released patch: v3.7.4), per https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vx5w-qrvp-mmcq. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct an immediate inventory of all SiYuan deployments and identify instances running versions prior to 3.7.4; restrict document import functionality from external sources and limit SiYuan access to essential personnel only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-73053 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy