CVE-2026-73053 — SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji
SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft docu…
Published: 2026-08-15 · CVSS: 9.4 · CVSS 4.0
SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code execution on the host system.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7