CVE-2026-73052
CriticalCVSS 9.0Summary
SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node integration enabled in the desktop client enabling code execution.
Risk Assessment
An attacker can execute arbitrary code in the desktop client context, potentially leading to session hijacking, data theft, or full system compromise.
Recommendation
Update SiYuan to version v3.7.4 or later, which includes a fix for HTML escaping of attribute-view field names.
Original NVD description (English source)
SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node integration enabled in the desktop client enabling code execution.