CVE-2026-73042CWE-79cross-site-scripting

CVE-2026-73042

Critical · published August 16, 2026

CVSS v3.1
9.0
EPSS
1%
Percentile
43.3
In the wild
Unconfirmed
What it is

SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitrary code via event handlers, reaching Node built-ins due to Electron's insecure configuration.

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00519 · 43.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-16T02:16Z
References (2)
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gcm3-qcq3-72rv · [email protected]https://www.vulncheck.com/advisories/siyuan-before-remote-code-execution-via-menu-metadata · [email protected]
EPSS history
Timeline
  • 15 AUG 21:44Z
    SiYuan before v3.7.4 Remote Code Execution via Menu Metadata
    cvelistv5