A critical (CVSS 9.0) remote code execution flaw in SiYuan versions before v3.7.4 lets attackers achieve arbitrary code execution through unsanitized Go template output rendered in the Node-integrated desktop client.
What Is It
SiYuan's Template calculation operator renders user-authored Go templates and stores the resulting output verbatim, without sanitization. An attacker can inject malicious HTML and JavaScript into a template calculation; that payload later executes inside the desktop client renderer, which runs with Node integration enabled. The result is arbitrary code execution when the affected database is opened.
The issue is classified as CWE-79 (improper neutralization of input during web page generation). It carries a base score of 9.0 (CRITICAL) with the recorded vector CVSS:4.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, and a secondary score of 9.4 (CRITICAL) recorded as CVSS 4.0. Note that the recorded base vector is internally inconsistent, it carries a CVSS 4.0 prefix but includes a Scope (S) metric, which exists only in CVSS 3.1, so the version attribution of the 9.0 score should be treated as unconfirmed pending clarification from the advisory publisher. Reading the metrics as given: attack vector is network, attack complexity is low, and only low privileges are required, but user interaction (opening the database) is needed to trigger execution. Scope is CHANGED, reflecting the escape from renderer content into the underlying host via Node integration.
Why It Matters
Because the injected payload is stored, not reflected, the malicious content persists in the notebook or database and fires whenever it is opened. A shared or synced SiYuan workspace becomes a delivery mechanism: any user who opens the poisoned database executes the attacker's code with the privileges of the desktop client. Confidentiality, integrity, and availability impacts are each rated HIGH in the recorded vector, and the CHANGED scope indicates that the damage is not confined to the renderer component where the flaw lives. The published 9.4 secondary score has no accompanying metric breakdown in either advisory, so no separate vulnerable-system versus subsequent-system impact ratings can be cited for this CVE.
As of publication, CVE-2026-73043 does not appear in the CISA Known Exploited Vulnerabilities catalog, and neither advisory records an exploit-maturity value; active exploitation is not confirmed.
What's Vulnerable
- Vendor/product: siyuan-note / siyuan
- Package:
pkg:golang/github.com/siyuan-note/siyuan/kernel - Affected: all versions before 3.7.4
- Not affected: 3.7.4 and later
The described attack path depends on the desktop client renderer running with Node integration enabled; no exploitation in the wild has been reported.
Patch Status
Version 3.7.4 is marked unaffected. Upgrade SiYuan to v3.7.4 or later. No CISA-mandated remediation deadline applies, as the CVE is absent from the KEV catalog.
Sources
- GitHub Security Advisory GHSA-rwh7-gm74-67h6; https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rwh7-gm74-67h6
- VulnCheck Advisory; https://www.vulncheck.com/advisories/siyuan-before-remote-code-execution-via-template-calculation
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog