SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-73041 2026-08-15

CVE-2026-73041: Critical Stored XSS to RCE in SiYuan PDF Annotations

"A stored cross-site scripting flaw in SiYuan's PDF annotation handling lets attacker-supplied markup execute as script with full Node.js access, escalating to remote code execution when a victim opens an annotated PDF."

A stored cross-site scripting flaw in SiYuan's PDF annotation handling lets attacker-supplied markup execute as script with full Node.js access, escalating to remote code execution when a victim opens an annotated PDF.

What Is It

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. An attacker can inject malicious markup into those annotation fields. When a user later opens the annotated PDF, the injected content executes as script inside the PDF renderer; a context that carries full Node.js access, turning a classic stored XSS (CWE-79) into code execution on the host.

The flaw is tracked as CVE-2026-73041, disclosed via VulnCheck, and carries a CVSS 3.1 base score of 9.0 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. A CVSS 4.0 score of 9.4 (Critical) is also assigned.

Why It Matters

The attack is network-reachable, low-complexity, and requires only low privileges; the attacker needs enough access to write an annotation, not administrative control. User interaction is required but passive: simply opening an annotated PDF is enough to trigger execution.

Because the payload lands in the PDF renderer with Node.js privileges, the scope is changed: the impact escapes the browser-style sandbox and reaches the underlying system, with high confidentiality, integrity, and availability impact both to the vulnerable component and to downstream systems.

The persistence model matters too: annotations are written to disk, so the payload survives until the file is opened, and any user who opens that document is a target.

What's Vulnerable

Patch Status

Upgrade to SiYuan v3.7.4 or later, which is marked unaffected. This CVE does not currently appear in the CISA KEV catalog, so no federally mandated remediation deadline applies. KEV listing reflects exploitation that CISA has confirmed and chosen to publish, so its absence is not evidence that exploitation is not occurring; only that none has been confirmed and catalogued to date. The NVD record status is Received, meaning analysis is still pending and details may be revised.

Sources