CVE-2026-73044

CRITICAL

CVE: CVE-2026-73044 - SiYuan versions before v3Sign in to save

CVSS

9.0

CVSS v3.1

EPSS

N/A

Exploit Prediction Score

Published

August 15, 2026

Exploitability

No EPSS data available

Description

SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can inject malicious payloads through the setAttrViewColWidth API that break out of style attributes and inject event handlers on every table cell, executing arbitrary code in the Electron renderer with Node integration enabled.

Weaknesses

CWE-79

Affected Packages

No package data available.

Aliases

CVE-2026-73044

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rj55-w3xr-gj62
https://www.vulncheck.com/advisories/siyuan-before-stored-cross-site-scripting-via-column-width