CVE-2026-74902
Received Received - Intake

SiYuan Cross-Site Scripting via Malicious Filename Upload

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access when a user drags, drops, or pastes the file into the editor.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-74902
EUVD
EUVD-2026-60583

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan before v3.7.4 has a cross-site scripting (XSS) vulnerability that allows attackers to execute remote code on a user's system. The flaw occurs when the application fails to properly escape filenames during file uploads, drag-and-drop, or paste operations. Malicious filenames containing script payloads are inserted directly into HTML without sanitization, enabling execution of arbitrary OS commands via Electron's nodeIntegration settings.

Detection Guidance

To detect this vulnerability, inspect SiYuan application files for versions before 3.7.4. Check for unpatched call sites in app/src/protyle/upload/index.ts and app/src/config/tabs/aiUi.ts. Monitor for unexpected script execution during file operations like drag-and-drop or paste.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system with the same privileges as the SiYuan application. If you drag, drop, or paste a file with a malicious filename into SiYuan, the embedded script can run commands like opening applications, accessing files, or installing malware without further user interaction.

Compliance Impact

This vulnerability could lead to data breaches, unauthorized access, or system compromise, violating GDPR's integrity and confidentiality requirements. For HIPAA, it risks exposing protected health information if attackers gain access to sensitive data. Organizations using SiYuan may face compliance violations and legal consequences due to inadequate security controls.

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later immediately. Disable file uploads or restrict to trusted sources. Review Electron settings to ensure nodeIntegration, contextIsolation, and webSecurity are properly configured. Monitor for suspicious activity in file operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74902. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart