A cross-site scripting flaw in SiYuan's unicode2Emoji function lets attacker-crafted document icons execute code in a Node-integrated renderer, giving arbitrary code execution on the host.
What Is It
CVE-2026-73053 is a cross-site scripting vulnerability (CWE-79) in SiYuan versions before v3.7.4. The unicode2Emoji function fails to sanitize output from its codepoint branch. An attacker can craft document icons containing hex-encoded markup that is rendered without sanitization. Because the renderer runs with Node integration enabled, the injected markup escapes the usual boundaries of a browser-context XSS and reaches the host system, resulting in arbitrary code execution.
The flaw carries a CVSS v3.1 base score of 9.0 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, network attack vector, low attack complexity, low privileges required, user interaction required, changed scope, and high impact to confidentiality, integrity, and availability. A secondary CVSS v4.0 assessment rates it 9.4 (CRITICAL). CVSS v4.0 has no scope metric; it models impact to the vulnerable system and to subsequent systems as separate metric groups, so the two scores are not directly comparable metric-for-metric.
Why It Matters
This is not a contained script-injection bug. Node integration in the renderer turns a document icon into an arbitrary code execution primitive on the machine running SiYuan. The changed-scope rating in the CVSS v3.1 vector reflects that the impact crosses out of the vulnerable component and into the underlying host; the same real-world consequence that drives the high v4.0 score.
Exploitation requires only low privileges and passive user interaction; a user opening or viewing a document carrying a malicious icon. In shared or synced notebook workflows, that makes malicious content a plausible delivery path.
No CISA KEV entry was supplied for this CVE, so there is no confirmed evidence of active exploitation in the wild at this time.
What's Vulnerable
- Vendor: siyuan-note
- Product: SiYuan (
pkg:golang/github.com/siyuan-note/siyuan/kernel) - Affected: all versions before 3.7.4
- Unaffected: 3.7.4 and later
No CPE entries were listed in the NVD record.
Patch Status
Fixed in SiYuan v3.7.4. Upgrade to v3.7.4 or later. The NVD record lists the CVE as Received (published 2026-08-15), and no CISA KEV remediation deadline or required action applies, as the CVE is not present in the supplied KEV data.
Sources
- NVD, CVE-2026-73053: https://nvd.nist.gov/vuln/detail/CVE-2026-73053
- GitHub Security Advisory GHSA-vx5w-qrvp-mmcq: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vx5w-qrvp-mmcq
- VulnCheck Advisory: https://www.vulncheck.com/advisories/siyuan-before-cross-site-scripting-via-unicode2emoji