CVE-2026-73043

CRITICAL

CVE: CVE-2026-73043 - SiYuan versions before v3Sign in to save

CVSS

9.0

CVSS v3.1

EPSS

N/A

Exploit Prediction Score

Published

August 15, 2026

Exploitability

No EPSS data available

Description

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in the desktop client renderer with Node integration enabled, allowing arbitrary code execution when the database is opened.

Weaknesses

CWE-79

Affected Packages

No package data available.

Aliases

CVE-2026-73043

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rwh7-gm74-67h6
https://www.vulncheck.com/advisories/siyuan-before-remote-code-execution-via-template-calculation