CVE-2026-73047 siyuan-note CVE debrief

Who should care

Users of siyuan versions <= 3.7.3, administrators of systems running siyuan, and security teams monitoring for potential vulnerabilities should review the patch status of their siyuan installations and assess potential exposure. Additionally, operators and platform administrators may need to review and update their configurations to prevent exploitation.

Technical summary

The attribute-view Template calculation feature in siyuan versions <= 3.7.3 contains a server-side template injection vulnerability. A local, unauthenticated attacker can inject a malicious Template calculation formula to read environment variables and perform DNS lookups. The vulnerability is due to the feature's template engine using Sprig's unmodified function map, which still exposes the env, expandenv, and getHostByName functions that were removed elsewhere for CVE-2024-55660.

Defensive priority

High priority due to potential for unauthorized access to sensitive environment variables.

Recommended defensive actions

• Apply the patch to upgrade to v3.7.4 or later
• Restrict access to the attribute-view Template calculation feature
• Monitor environment variables for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was introduced in v3.7.0-beta.1 and fixed in v3.7.4. The feature's template engine uses Sprig's unmodified function map, exposing the env, expandenv, and getHostByName functions. This server-side template injection vulnerability allows a local, unauthenticated attacker to inject a malicious Template calculation formula to read environment variables belonging to the account running siyuan — including from a separate, unprivileged OS account — and to perform DNS lookups from the server's network position. The affected product deployments should be reviewed for potential exposure, and defenders should verify the patch status of their siyuan installations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.