What’s Vulnerable › Vulnerabilities

CVE-2026-73043: SiYuan before v3.7.4 Remote Code Execution via Template Calculation

• Severity: critical (CVSS 9.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-15 · updated 2026-08-26
• Weakness: CWE-79

Description

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in the desktop client renderer with Node integration enabled, allowing arbitrary code execution when the database is opened.

Affected products

• siyuan-note siyuan: before 3.7.4 — fixed in 3.7.4

How to fix

Upgrade to a fixed version: siyuan-note siyuan 3.7.4. Check the vendor advisory for mitigations.

References

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rwh7-gm74-67h6
• https://www.vulncheck.com/advisories/siyuan-before-remote-code-execution-via-template-calculation

Get alerted when CVE-2026-73043 or the next vulnerability affects your stack