CVE-2026-74800
CriticalCVSS 9.0Summary
SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace owner opens the asset link.
Risk Assessment
The risk is that malicious scripts can execute in the context of the workspace owner's browser, potentially leading to data theft or application takeover.
Recommendation
It is recommended to upgrade SiYuan to version 3.7.4 or later, which sets appropriate security headers.
Original NVD description (English source)
SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace owner opens the asset link.