PT-2026-73057

CVE-2026-73053

Published

2026-08-15

Updated

2026-08-26

Description by

CVSS 3.1

9.0

Critical

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description A cross-site scripting issue exists in the unicode2Emoji() function due to a failure to sanitize codepoint branch output. This allows attackers to create document icons containing hex-encoded markup. When processed by the renderer with Node integration enabled, this can lead to arbitrary code execution on the host system.

Recommendations Update to version 3.7.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Shirshakhtml

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers