CVE-2026-73042
CriticalCVSS 9.0Summary
SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitrary code via event handlers, reaching Node built-ins due to Electron's insecure configuration.
Risk Assessment
An attacker can execute arbitrary code in the application context, potentially leading to session hijacking, data theft, or full system compromise.
Recommendation
Update SiYuan to version v3.7.4 or later, which includes a fix for escaping database menu metadata.
Original NVD description (English source)
SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitrary code via event handlers, reaching Node built-ins due to Electron's insecure configuration.