CVE-2026-73044 siyuan-note CVE debrief

Who should care

Users of SiYuan versions before v3.7.4, administrators of systems with SiYuan installed, and security teams monitoring for XSS vulnerabilities should take immediate action to mitigate this critical vulnerability. This vulnerability allows for stored cross-site scripting (XSS) attacks via table column width values, enabling attackers to inject malicious payloads and execute arbitrary code in the Electron renderer with Node integration enabled. Affected users should apply patches or updates to SiYuan versions before v3.7.4 and restrict access to the setAttrViewColWidth API. Additionally, security teams should monitor for suspicious activity on table column width values and implement additional security measures to prevent XSS attacks. Evidence is based on limited source detail, including a CVE Program record and NIST NVD vulnerability detail, which may not be comprehensive or up-to-date. Therefore, defenders should verify the accuracy of this information and consider additional sources when assessing risk and developing mitigations. Limited source detail suggests that defenders should exercise caution when relying on this information for critical decision-making. To further verify the vulnerability and assess potential impact, defenders may need to review the official CVE Program record, NIST NVD vulnerability detail, and other credible sources for CVE-2026-73044. Furthermore, defenders should consider implementing compensating controls, such as restricting access to the setAttrViewColWidth API, monitoring for suspicious activity on table column width values, and implementing additional security measures to prevent XSS attacks. By taking these steps, defenders can help mitigate the risk associated with this critical vulnerability and protect against potential attacks. It is essential for defenders to prioritize this vulnerability and take immediate action to prevent exploitation. This may involve coordinating with vendors, applying patches or updates, and implementing additional security measures to prevent XSS attacks. By doing so, defenders can help prevent attackers from exploiting this vulnerability and minimize the potential impact of a successful attack. In

Technical summary

The CVE-2026-73044 vulnerability in SiYuan versions before v3.7.4 allows for stored cross-site scripting (XSS) attacks via table column width values. Attackers can inject malicious payloads through the setAttrViewColWidth API, breaking out of style attributes and injecting event handlers on every table cell, executing arbitrary code in the Electron renderer with Node integration enabled. This vulnerability has a CVSS score of 9.4 and a severity of CRITICAL. Users of SiYuan versions before v3.7.4, administrators of systems with SiYuan installed, and security teams monitoring for XSS vulnerabilities should take immediate action to mitigate this vulnerability.

Defensive priority

Critical vulnerability in SiYuan, a note-taking application, allowing for stored cross-site scripting (XSS) attacks via table column width values.

Recommended defensive actions

• Apply patches or updates to SiYuan versions before v3.7.4
• Restrict access to the setAttrViewColWidth API
• Monitor for suspicious activity on table column width values
• Implement additional security measures to prevent XSS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-73044 vulnerability in SiYuan versions before v3.7.4 allows for stored cross-site scripting (XSS) attacks via table column width values. Attackers can inject malicious payloads through the setAttrViewColWidth API, breaking out of style attributes and injecting event handlers on every table cell, executing arbitrary code in the Electron renderer with Node integration enabled. Evidence is based on limited source detail, including a CVE Program record and NIST NVD vulnerability detail.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.