Description
SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code execution on the host system.
Published: 2026-08-15
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

SiYuan versions prior to 3.7.4 contain a cross‑site scripting flaw in the unicode2Emoji function. The function fails to sanitize certain codepoint branch outputs, allowing an attacker to embed hex‑encoded markup within document icons. When the renderer has Node integration enabled, that markup is executed in the host process, resulting in arbitrary code execution on the user’s machine.

Affected Systems

Affected by product SiYuan, vendor siyuan‑note. All releases before version 3.7.4 are vulnerable.

Risk and Exploitability

The vulnerability receives a CVSS score of 9.4, indicating critical severity, but EPSS information is not available and it is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a specially crafted document icon to a user running SiYuan with Node integration enabled. Once such a document is rendered, the attacker can execute arbitrary code on the host system.

Generated by OpenCVE AI on August 15, 2026 at 23:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update SiYuan to version 3.7.4 or later where unicode2Emoji sanitization is fixed.
  • If an upgrade is delayed, disable Node integration in the SiYuan renderer so embedded markup cannot execute host code.
  • Remove or sanitise document icons that contain hex‑encoded markup before opening them in SiYuan.

Generated by OpenCVE AI on August 15, 2026 at 23:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 17 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Siyuan
Siyuan siyuan
Vendors & Products Siyuan
Siyuan siyuan

Sat, 15 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Description SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code execution on the host system.
Title SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji
First Time appeared B3log
B3log siyuan
Weaknesses CWE-79
CPEs cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*
Vendors & Products B3log
B3log siyuan
References
Metrics cvssV3_1

{'score': 9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

B3log Siyuan
Siyuan Siyuan
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-18T02:22:06.694Z

Reserved: 2026-08-10T19:10:18.100Z

Link: CVE-2026-73053

cve-icon Vulnrichment

Updated: 2026-08-18T02:22:02.483Z

cve-icon NVD

Status : Deferred

Published: 2026-08-15T22:16:55.157

Modified: 2026-08-26T17:04:11.547

Link: CVE-2026-73053

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T10:30:08Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')