SiYuan CVE-2026-73041–73054: stored XSS becomes Electron RCE

On 15 August 2026, CVE databases published a wave of records affecting SiYuan before version 3.7.4. Many share one pattern: document or database content is stored without a strict model, later reaches HTML through innerHTML or insertAdjacentHTML, and script executes in the Electron desktop renderer. Because application windows expose Node.js, conventional stored XSS can cross the interface boundary and become code execution on the user’s computer.

The records include CVE-2026-73041 for PDF annotations, CVE-2026-73042 for database-menu metadata, CVE-2026-73043 for Template calculations, CVE-2026-73044 for column width and further flaws in attribute-view fields and icons. Many score up to 9.4 under CVSS 4.0. Separate findings cover access-code brute force and a WebSocket authentication bypass.

This article extends the previous day’s SiYuan analysis: SQL injection concerned the SQLite data boundary, while the 15 August wave exposes the boundary between content, the DOM and the operating system.

The common impact multiplier: Electron configuration

In an ordinary web application, XSS acts inside an origin: it can read visible data, make requests and steal a session. It remains serious, but the browser sandbox separates a page from host files and processes.

The SiYuan desktop client uses Electron. Advisories identify nodeIntegration: true, contextIsolation: false and webSecurity: false in renderer windows. Under that model, JavaScript running in the DOM can reach Node modules, making the XSS-to-RCE boundary extremely thin. A sanitizer is not merely protecting page appearance; it is a barrier before operating-system access.

Electron is not inherently unsafe. A safer profile disables Node Integration in renderers, enables context isolation and sandboxing, then exposes only narrow validated operations through a preload bridge. When a renderer holds full capabilities, every missed escape inherits maximum impact.

CVE-2026-73041: a PDF annotation carries code

The CVE-2026-73041 advisory describes setFileAnnotation writing a client-supplied string to a .sya sidecar without parsing or schema validation. During PDF rendering, showHighlight interpolates several annotation fields directly into HTML attributes and appends the result through insertAdjacentHTML.

The annotation is not merely local UI state. Its sidecar travels with the PDF through export, import, synchronisation and rename. A shared notebook or package containing a PDF can carry the payload to another device. Execution occurs when the recipient opens the document and the renderer draws annotations.

Nearby code uses setAttribute for one field, demonstrating the safer construction method. Partial correctness is not enough. Every data-controlled field needs a safe DOM API or consistent context-aware encoding.

CVE-2026-73043: Template calculation becomes HTML

The CVE-2026-73043 advisory covers the database Template calculation operator. The server renders a Go text/template and stores the result as plain text. The client places it inside a span and assigns the assembled fragment through innerHTML.

Conventional template injection invoking dangerous functions is unnecessary. Go text/template passes literal text, so the output itself can carry markup. The project already had getAVTemplateHTML with DOMPurify for the related template-column path, but the calculation route never called it. Two functions presenting the same data type enforced different policies.

Content can travel through import, synchronisation, shared workspaces or distributed packages. Opening a view that displays the calculation footer triggers rendering. In the desktop client, Node Integration extends impact beyond the DOM.

CVE-2026-73042 and 73044: metadata is active content too

CVE-2026-73042 covers field names and descriptions used in group, view and edit menus. The menu-metadata advisory shows a value escaped in one attribute while remaining raw in the body of the same HTML line. A user reached the sink by opening a particular menu.

CVE-2026-73044 concerns attribute-view column widths. The column-width advisory documents a value stored through the API without validation and later interpolated into a style attribute. Malicious content could leave the style context and attach an event handler across many cells.

Further records cover select-option colours, sort-menu field names and Unicode icon conversion. Locations vary, but the flow remains stored untrusted value → later read → HTML interpolation → execution in a privileged renderer.

Why a list of individual escapes is insufficient

Encoding is context dependent. Element text, an HTML attribute, URL, CSS and JavaScript all require different rules. A function safe for span text may be unsafe inside style. Adding manual escaping at each site invites inconsistency and regression.

Prefer constructing elements with textContent, setAttribute and typed DOM properties. If an application intentionally supports HTML fragments, it needs one central sanitizer with a documented profile and tests. Data stored as text should remain text through rendering.

The second layer is renderer capability reduction. Even if one XSS survives sanitisation, disabling Node Integration and using an isolated preload bridge limits impact. Defence in depth matters because a large editor has many sinks and content formats.

Who is exposed

The advisories mark releases before v3.7.4 as affected. The Electron desktop client presents the highest risk because JavaScript can reach Node. Web variants may still expose application data and operations through XSS even when they do not provide direct host RCE.

Teams synchronising shared workspaces, importing databases or packages, and opening documents from others deserve priority. An attacker need not send a conventional executable. The payload may hide in a field that looks like metadata, width, colour or annotation.

Developer workstations increase blast radius. SiYuan running as an account with SSH keys, Git tokens, cloud configuration and VPN access can expose valuable context. A notes application often stays open all day and synchronises automatically.

What defenders should do now

Upgrade SiYuan to v3.7.4 or a later stable release containing the fixes. Inventory every desktop client, Docker image and shared node. Updating the server while leaving an old desktop application does not remove sinks in the local renderer.

Until rollout, avoid importing untrusted workspaces, packages and annotated PDFs. Restrict sharing and synchronisation to trusted sources. Disabling JavaScript snippets is insufficient because these paths use ordinary data and HTML features.

Where practical, run the client under an account without secrets and with limited network access. Organisations can enforce an allowed-version baseline and block older images in deployment pipelines. Back up workspaces before migration, while keeping potentially malicious data quarantined.

Detection and response

Scan workspaces for unusual markup in annotation files, Template formulas, field names and descriptions, widths, colours and icons. Values containing tags, attribute-breaking quotes or event handlers require review. Scan a copy rather than opening the active workspace in an affected client.

At the API, monitor setFileAnnotation, setAttrViewColCalc, setAttrViewColWidth and related metadata operations. Correlate them with later document opens, child-process starts, unusual file access and new outbound connections from SiYuan.

If evidence suggests code execution, handle the host as potentially compromised. Stop synchronisation, preserve data and logs, rotate accessible tokens and rebuild the application from a trusted source. Removing one suspicious annotation does not prove the operating system has no persistence.

Facts and Breachroad conclusions

The 15 August CVE wave covers multiple unsanitised data paths in SiYuan before v3.7.4, with many records scoring 9.4. Project advisories document flows into innerHTML or insertAdjacentHTML and an Electron configuration with Node Integration. They do not establish widespread exploitation in the wild.

Breachroad’s conclusion is that repetition points to an architectural sink-and-capability problem rather than several unrelated typos. The strongest remediation combines one trusted rendering model for untrusted content with an isolated renderer whose compromise does not grant operating-system access.

If your organisation builds Electron tools or processes shared content, our web application and API penetration testing can assess data flows and client/backend boundaries. Product teams can complement that work with cybersecurity training for organisations focused on secure by design and impact modelling.