A stored cross-site scripting flaw in SiYuan's table column width handling allows attackers to inject event handlers into every table cell and execute arbitrary code in the Electron renderer, which runs with Node integration enabled.
What Is It
SiYuan versions before v3.7.4 fail to validate or escape table column width values. Values submitted through the setAttrViewColWidth API are written directly into style attributes without sanitization, letting an attacker break out of the style attribute context and inject arbitrary event handlers onto every cell in the affected table.
Because the payload is stored, it fires whenever a victim opens the poisoned document. The vulnerability is classified as CWE-79 (improper neutralization of input during web page generation) and carries a CVSS 3.1 base score of 9.0 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. The CVSS 4.0 assessment from the same source scores it 9.4 (CRITICAL).
Why It Matters
This is not a browser-sandboxed XSS. The injected code executes in the Electron renderer with Node integration enabled, which converts a content injection bug into arbitrary code execution on the host. The CVSS vectors reflect that escalation: scope is CHANGED, all three impact metrics (confidentiality, integrity, availability) are HIGH, and the CVSS 4.0 subsequent-system impacts are likewise all HIGH.
Attack requirements are low. The attack vector is NETWORK with LOW complexity, requires only LOW privileges, and needs passive user interaction; the victim only has to view the document containing the stored payload.
This CVE does not appear in the CISA KEV catalog; there is no confirmation of active exploitation in the supplied data, and no KEV remediation deadline or required action applies.
What's Vulnerable
- Vendor/product: siyuan-note / siyuan
- Package:
pkg:golang/github.com/siyuan-note/siyuan/kernel - Affected versions: all versions before 3.7.4
- Fixed version: 3.7.4 and later (marked unaffected)
Electron desktop deployments with Node integration enabled carry the full code-execution impact.
Patch Status
Fixed in SiYuan v3.7.4. Upgrade to v3.7.4 or later. The vendor has published a GitHub security advisory (GHSA-rj55-w3xr-gj62) covering the issue. No workarounds are listed in the supplied source material.
Sources
- NVD, CVE-2026-73044: https://nvd.nist.gov/vuln/detail/CVE-2026-73044
- GitHub Security Advisory GHSA-rj55-w3xr-gj62: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rj55-w3xr-gj62
- VulnCheck Advisory: https://www.vulncheck.com/advisories/siyuan-before-stored-cross-site-scripting-via-column-width