Critical CVSS 9
CVE-2026-73052
NVD analysis in progress
SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node integration enabled in the desktop client enabling code execution.
What this means
- Exposure
- Exploitable remotely over the network and with an ordinary user account — but only if a user opens booby-trapped content.
- Impact
- An attacker can read sensitive data, modify or destroy data and take the service offline. The impact spreads beyond the vulnerable component into other parts of the system.
- Weakness
- Attacker-supplied script runs in other users’ browsers (cross-site scripting).
- Likelihood
- Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.
What to doPatch without waiting for the next scheduled cycle.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.