CVE-2026-73042 — SiYuan before v3.7.4 Remote Code Execution via Menu Metadata
SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit m…
Published: 2026-08-15 · CVSS: 9.4 · CVSS 4.0
SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitrary code via event handlers, reaching Node built-ins due to Electron's insecure configuration.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7