SiYuan Template calculation RCE via Go template injection in Electron
SiYuan before v3.7.4 renders user-authored Go templates verbatim without sanitization in its Template calculation operator; injected HTML/JavaScript executes in the Electron renderer with Node integration enabled, achieving arbitrary code execution on the host.
- Vendor
- SiYuan
- Product
- SiYuan (all versions before 3.7.4)
- CVSS
- 9.0
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
SiYuan’s Template calculation operator renders user-authored Go templates and stores the output without sanitization. An attacker who can author a template can inject malicious HTML and JavaScript; the Electron desktop client’s renderer executes it with Node.js integration enabled, granting access to the host filesystem and OS. Code execution triggers when the database containing the malicious template is opened.
Part of a batch of eleven CVEs — five rated critical — all patched in SiYuan v3.7.4. See the full disclosure writeup for the complete list.
Affected versions: All SiYuan releases before v3.7.4.
Patch: Update to SiYuan v3.7.4.
NVD record: CVE-2026-73043
