PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-73052 siyuan-note CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-15T22:16:55.017Z and has not been modified since then. The NVD entry is currently Deferred. This critical vulnerability in SiYuan before v3.7.4 results from storing attribute-view field names without HTML escaping and interpolating them directly into option elements via innerHTML in the sort menu. This allows attackers to inject markup by renaming a database field, which can execute arbitrary JavaScript when users open the sort menu. With Node integration enabled in the desktop client, this enables code execution. Users of SiYuan note-taking application, especially those with Node integration enabled in the desktop client, should be aware of this critical vulnerability and take immediate action to patch or mitigate. The vulnerability has a CVSS score of 9.4 and is classified as CRITICAL.

Vendor
siyuan-note
Product
siyuan
CVSS
CRITICAL 9.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-15
Original CVE updated
2026-08-26
Advisory published
2026-08-15
Advisory updated
2026-08-26

Who should care

Users of SiYuan note-taking application, especially those with Node integration enabled in the desktop client, should be aware of this critical vulnerability and take immediate action to patch or mitigate.

Technical summary

The CVE-2026-73052 vulnerability in SiYuan before v3.7.4 results from storing attribute-view field names without HTML escaping and interpolating them directly into option elements via innerHTML in the sort menu. This allows attackers to inject markup by renaming a database field, which can execute arbitrary JavaScript when users open the sort menu. With Node integration enabled in the desktop client, this enables code execution. The vulnerability has a CVSS score of 9.4 and is classified as CRITICAL.

Defensive priority

Critical vulnerability in SiYuan, a note-taking application, allowing for arbitrary JavaScript execution via stored XSS.

Recommended defensive actions

  • Inventory and verify affected SiYuan installations
  • Apply vendor patches or upgrade to v3.7.4 or later
  • Implement compensating controls such as Content Security Policy (CSP)
  • Monitor for suspicious activity and exception tracking
  • Retest and validate fixes

Evidence notes

The CVE-2026-73052 vulnerability in SiYuan before v3.7.4 results from storing attribute-view field names without HTML escaping and interpolating them directly into option elements via innerHTML in the sort menu. This allows attackers to inject markup by renaming a database field, which can execute arbitrary JavaScript when users open the sort menu. With Node integration enabled in the desktop client, this enables code execution. The vulnerability has a CVSS score of 9.4 and is classified as CRITICAL.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-73052 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-73052

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-73052 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-73052

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.