A stored cross-site scripting flaw in the SiYuan note-taking application allows an attacker who can rename a database field to execute arbitrary JavaScript, and, on the desktop client, arbitrary code, when a victim opens the sort menu.
What Is It
SiYuan versions before v3.7.4 store attribute-view field names without HTML escaping and interpolate them directly into option elements via innerHTML in the sort menu. An attacker with the ability to rename a database field can inject markup that executes arbitrary JavaScript when a user later opens that sort menu. Because the desktop client runs with Node integration enabled, that script execution escalates into code execution on the host.
The issue is tracked as CWE-79 (Improper Neutralization of Input During Web Page Generation) and was disclosed by VulnCheck.
Why It Matters
The vulnerability carries a CVSS v3.1 base score of 9.0 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. A CVSS v4.0 score of 9.4 (CRITICAL) was also assigned. The vector reflects a network-reachable attack requiring only low privileges and low complexity, with a changed scope and high impact to confidentiality, integrity, and availability.
The payload is stored, not reflected; it persists in the field name and fires whenever a user opens the sort menu, so exploitation only needs passive user interaction rather than a crafted link or social-engineering lure.
As of publication, CVE-2026-73052 is not listed in the CISA Known Exploited Vulnerabilities catalog, and no active exploitation has been confirmed. Exploit maturity in the CVSS v4.0 vector is NOT_DEFINED.
What's Vulnerable
- Vendor: siyuan-note
- Product: siyuan (
pkg:golang/github.com/siyuan-note/siyuan/kernel) - Affected: all versions before 3.7.4
- Not affected: 3.7.4 and later
The desktop client is specifically called out as the higher-impact target due to Node integration being enabled.
Patch Status
Version 3.7.4 is marked unaffected. Upgrading SiYuan to v3.7.4 or later remediates the issue. Neither GitHub Security Advisory GHSA-g3jx-227v-x2x4 nor the VulnCheck advisory lists any mitigation or workaround short of upgrading, and no CISA KEV due date applies.