CVE-2026-73041

CRITICAL

CVE: CVE-2026-73041 - SiYuan versions before v3Sign in to save

CVSS

9.0

CVSS v3.1

EPSS

N/A

Exploit Prediction Score

Published

August 15, 2026

Exploitability

No EPSS data available

Description

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.

Weaknesses

CWE-79

Affected Packages

No package data available.

Aliases

CVE-2026-73041

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fqpw-c3pj-w8g9
https://www.vulncheck.com/advisories/siyuan-before-remote-code-execution-via-pdf-annotations