CVE-2026-73042

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description Improper escaping of database menu metadata during HTML interpolation allows stored values to execute scripts when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names to close containing elements and execute arbitrary code via event handlers. This is further exacerbated by an insecure Electron configuration that allows access to Node built-ins.

Recommendations Update SiYuan to version 3.7.4 or later.