SiYuan v3.7.4 Patches 11 CVEs, Critical RCE Confirmed

Eleven CVEs. Five critical. All patched in SiYuan v3.7.4.

The open-source self-hosted note-taking and knowledge management app published the release on August 15 via coordinated GitHub Security Advisories. No active exploitation confirmed at time of publication — treat that as a narrow window, not a grace period. Public proof-of-concept conditions exist for the XSS attack surfaces.

The Electron Problem

SiYuan runs an Electron desktop client with Node.js integration enabled. In this configuration, a stored cross-site scripting vulnerability that would be contained damage in a browser becomes arbitrary code execution on the host system. The kernel binds to 127.0.0.1 by default, but that’s cold comfort when five separate injection paths lead to the same outcome.

CVE-2026-73043 — CVSS 9.0, Critical. The Template calculation operator renders user-authored Go templates without sanitization and stores output verbatim. Attackers inject HTML and JavaScript into template calculations; the Electron renderer executes them with Node integration enabled. Code execution when the database is opened. No special privilege required — any user who can author a template qualifies.

CVE-2026-73044 — CVSS 9.0, Critical. Table column width values written via the setAttrViewColWidth API are injected into style attributes without escaping. Injected event handlers fire on every table cell render.

CVE-2026-73041 — CVSS 9.0, Critical. Annotation fields saved by the setFileAnnotation endpoint are rendered unsanitized in the PDF viewer, which also runs with Node.js access. Malicious markup executes when a user opens an annotated PDF.

CVE-2026-73042 — CVSS 9.0, Critical. Database menu metadata — group names, view names, field descriptions — is interpolated directly into HTML. Injected markup breaks out of containing elements and runs event handlers when users open group, view, or field-edit menus.

CVE-2026-73053 — CVSS 9.0, Critical. The unicode2Emoji function fails to sanitize codepoint branch output. Crafted document icons with hex-encoded markup execute in the renderer.

Additional stored XSS paths fixed in the same release: CVE-2026-73050 (CVSS 9.0, color field in attribute-view select options, eight unescaped render sites) and CVE-2026-73052 (CVSS 9.0, attribute-view field names injected via innerHTML in the sort menu).

Authentication Failures

CVE-2026-73046 — CVSS 9.8, Critical. The most severe in the batch. The CheckAuth() middleware guards the /api/* surface via HTTP Basic Authentication, accepting the workspace access code as the Basic Auth password. The Basic Auth branch never consults the CAPTCHA gate or increments the failure counter used by the cookie/session login path. Result: unauthenticated remote attackers can brute-force the admin access code with unlimited automated requests. No lockout. No rate limit.

CVE-2026-73054 — CVSS 7.5, High. WebSocket endpoint authentication bypassed via differential parsing of duplicated query parameters. The exemption check and the session quarantine check interpret the URI differently; a crafted WebSocket URI with duplicated parameters clears auth and receives the live kernel event stream — document identifiers, titles, operation logs.

CVE-2026-73045 — CVSS 7.5, High. Per-notebook publish passwords at authFilePublishAccess have no rate limiting or CAPTCHA. Unbounded brute-force against published notebook passwords.

Server-Side Template Injection

CVE-2026-73047 — CVSS 6.2, Medium. The attribute-view Template calculation feature (added in v3.7.0-beta.1) uses Sprig’s unmodified function map, including env, expandenv, and getHostByName — functions removed from Sprig elsewhere specifically to address CVE-2024-55660. The kernel binds to localhost by default, but any local unauthenticated process can inject a malicious template. Exploitation confirmed possible; exploitation in the wild unconfirmed.

Exploitation Status

Active exploitation: unconfirmed at time of publication. All disclosures originate from the siyuan-note GitHub Security Advisories, published coordinated with the v3.7.4 release. The XSS attack surfaces — column widths, field names, color values, document icons — are trivially reachable by any user who can edit a document or database. Treat exploitability as high.

Analysis: the Electron architecture is the force multiplier across all five XSS-to-RCE paths. The pattern is well-established and recurring; see also the Electron desktop client attack chain documented in July. Content isolation was not enabled. The same class of issue has burned other Electron apps before and will again until Node integration is disabled by default.

What to Do

Update to SiYuan v3.7.4. All eleven CVEs are fixed in this release.

If you were running an exposed SiYuan instance — even LAN-accessible only — treat the workspace access code as potentially enumerated given the CVE-2026-73046 brute-force window. Rotate it post-patch.

Published notebooks with per-notebook passwords: consider those passwords potentially compromised. Reset and re-notify authorized readers.

WebSocket event stream: if the endpoint was externally accessible, audit connection logs for unexpected sessions prior to the patch.

Full advisory index: siyuan-note Security Advisories on GitHub.

Related coverage: WordPress 7.0.4 RCE via Imagick · WordPress plugin auth bypass CVSS 9.8