CVE-2026-73041
CriticalCVSS 9.0Summary
SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.
Risk Assessment
An attacker can execute arbitrary code with full Node.js access, potentially leading to full system compromise, data theft, or malware installation.
Recommendation
Update SiYuan to version v3.7.4 or later, which includes a fix for validation and escaping of annotation fields.
Original NVD description (English source)
SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.