CVE-2026-74902

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description A cross-site scripting issue exists in the file upload validation flow. The software fails to escape filenames before inserting them into HTML using the insertAdjacentHTML() function. This allows attackers to use malicious filenames containing script payloads that can execute with full OS command access when a user drags, drops, or pastes a file into the editor.

Recommendations Update SiYuan to version 3.7.4 or later.