Critical severity9.0NVD Advisory· Published Aug 15, 2026· Updated Aug 26, 2026
CVE-2026-73052
CVE-2026-73052
Description
SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node integration enabled in the desktop client enabling code execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <3.7.4
Patches
Vulnerability mechanics
References
2News mentions
2- Siyuan Note: 25 Vulnerabilities Including RCE and Auth Bypass Disclosed TogetherVypr Intelligence · Aug 18, 2026
- Siyuan Note: 25 Vulnerabilities Including RCE and Auth Bypass Disclosed TogetherVypr Intelligence · Aug 15, 2026