CVE-2026-73053

Received Received - Intake

SiYuan XSS via Unicode Emoji Renderer Before v3.7.4

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: VulnCheck

Description

SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code execution on the host system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-15

Generated

2026-08-16

AI Q&A

2026-08-16

EPSS Evaluated

N/A

NVD

CVE-2026-73053

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

SiYuan versions before v3.7.4 have a cross-site scripting flaw in the unicode2Emoji function. It fails to properly sanitize codepoint outputs, allowing attackers to inject hex-encoded markup into document icons. When rendered with Node integration enabled, this executes arbitrary code on the host system.

Detection Guidance

This vulnerability involves a cross-site scripting issue in SiYuan versions before v3.7.4. To detect it, check the installed version of SiYuan on your system. If it is below v3.7.4, the system is vulnerable. No specific commands are provided in the context for detection.

Impact Analysis

An attacker could exploit this to run malicious code on your system if you use a vulnerable SiYuan version. This could lead to data theft, system compromise, or further network infiltration depending on your environment and permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information integrity, potentially leading to breaches and compliance failures.

Mitigation Strategies

Immediately update SiYuan to version v3.7.4 or later to patch the vulnerability. If updating is not possible, consider disabling Node integration in the renderer or restricting user access to document icon features until the update is applied.

Hi! I’m here to help you understand CVE-2026-73053. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70