CVE-2026-73052

Received Received - Intake

SiYuan Desktop Client Stored XSS via Sort Menu

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: VulnCheck

Description

SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node integration enabled in the desktop client enabling code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-15

Generated

2026-08-16

AI Q&A

2026-08-16

EPSS Evaluated

N/A

NVD

CVE-2026-73052

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

SiYuan before v3.7.4 has a stored cross-site scripting (XSS) vulnerability where field names in attribute views are not HTML-escaped. When users open the sort menu, these field names are directly inserted into HTML option elements via innerHTML, allowing attackers to inject malicious scripts by renaming a database field. If Node integration is enabled in the desktop client, this can lead to arbitrary code execution.

Detection Guidance

Check SiYuan versions below v3.7.4 for the vulnerability. Inspect database field names for HTML special characters or script tags. Review sort menu options for unexpected markup execution.

Impact Analysis

If you use SiYuan before v3.7.4 with Node integration enabled, an attacker could trick you into opening a malicious sort menu. This could execute arbitrary JavaScript in your client, potentially stealing sensitive data, installing malware, or taking control of your system.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. A successful exploit may result in data breaches, triggering legal penalties and compliance violations.

Mitigation Strategies

Upgrade SiYuan to v3.7.4 or later. Disable Node integration in the desktop client if enabled. Audit database fields for malicious names and remove any containing HTML or JavaScript.

Hi! I’m here to help you understand CVE-2026-73052. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70