CVE-2026-73042

CRITICAL

CVE: CVE-2026-73042 - SiYuan before v3Sign in to save

CVSS

9.0

CVSS v3.1

EPSS

N/A

Exploit Prediction Score

Published

August 15, 2026

Exploitability

No EPSS data available

Description

SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitrary code via event handlers, reaching Node built-ins due to Electron's insecure configuration.

Weaknesses

CWE-79

Affected Packages

No package data available.

Aliases

CVE-2026-73042

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gcm3-qcq3-72rv
https://www.vulncheck.com/advisories/siyuan-before-remote-code-execution-via-menu-metadata