CVE-2026-73042

Received Received - Intake

SiYuan Stored Cross-Site Scripting via Database Menu Metadata

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: VulnCheck

Description

SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitrary code via event handlers, reaching Node built-ins due to Electron's insecure configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-15

Generated

2026-08-16

AI Q&A

2026-08-16

EPSS Evaluated

N/A

NVD

CVE-2026-73042

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

SiYuan before v3.7.4 has a stored cross-site scripting (XSS) vulnerability due to improper escaping of database menu metadata in HTML interpolation. Attackers can inject malicious scripts through field descriptions or names, which execute when users open group, view, or field-edit menus. The vulnerability leverages Electron's insecure configuration to reach Node built-ins via event handlers.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system when you interact with vulnerable menus. It can lead to data theft, unauthorized access, or further compromise of your device. Users of SiYuan versions before v3.7.4 are at risk if they open or edit fields with malicious descriptions or names.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using affected SiYuan versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade SiYuan to version v3.7.4 or later to address the improper HTML escaping issue. Review and sanitize any field descriptions or names that may contain malicious markup before upgrading.

Hi! I’m here to help you understand CVE-2026-73042. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70