CVE-2026-73043

Received Received - Intake

Remote Code Execution in SiYuan via Malicious Template Calculations

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: VulnCheck

Description

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in the desktop client renderer with Node integration enabled, allowing arbitrary code execution when the database is opened.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-15

Generated

2026-08-16

AI Q&A

2026-08-16

EPSS Evaluated

N/A

NVD

CVE-2026-73043

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

SiYuan versions before v3.7.4 have a remote code execution flaw in the Template calculation operator. User-authored Go templates are rendered and stored without sanitization, allowing attackers to inject malicious HTML and JavaScript into template calculations. This executes in the desktop client renderer with Node integration enabled, enabling arbitrary code execution when the database is opened.

Detection Guidance

Detecting this vulnerability requires checking for SiYuan versions before v3.7.4. Inspect the installed version via the application's about section or configuration files. No specific network commands are provided for detection.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary code on your system when you open a malicious database. This could lead to data theft, system compromise, or further network infiltration. Users of affected SiYuan versions are at risk if they interact with compromised templates.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade SiYuan to version v3.7.4 or later immediately. Disable Node integration in the desktop client renderer if possible. Avoid using untrusted templates or calculations.

Hi! I’m here to help you understand CVE-2026-73043. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70