External risk intelligence

SiYuan Template Calculation Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-73043

The vulnerability resides in a desktop client application and requires the opening of a database file to trigger. It is not an internet-facing service, API, or edge gateway, and typical deployment involves local, isolated usage on a user's machine.

Cross-site Scripting

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the SiYuan application's template calculation operator, where un-sanitized user input can lead to the execution of malicious code within the desktop client. This could allow attackers to run arbitrary commands when a specially crafted database is opened.

Code execution risk via user-sent templates.
Confirms core application exposure to malicious data.
Assess if your users open shared SiYuan databases.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a user into opening a specially crafted database file. This would allow the attacker to execute arbitrary code on the user's desktop client by leveraging unsanitized output from template calculations.

Requires user to open malicious database.
Unsanitized template calculation output.
Arbitrary code execution on desktop client.

Live Threat

Current exploitation, exposure, and threat context

When a user opens a specially crafted database, attackers could inject malicious code into template calculations that then executes with Node integration enabled. This could lead to arbitrary code execution on the user's desktop client.

User's desktop client code execution.
Opening a malicious database file.
System compromise or data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

SiYuan's desktop client is susceptible to remote code execution via the template calculation operator. This vulnerability requires user interaction, such as opening a malicious database file, to be exploited. The primary responsibility for addressing this issue likely falls to the application owners and potentially the security team, in coordination with end-users or device management. The first step is to identify all deployments of SiYuan, assess their potential exposure, and confirm ownership before planning remediation.

Confirm affected application owners.
Verify database reachability and criticality.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the SiYuan application?

SiYuan is a privacy-first, local-first personal knowledge management software. It functions as a note-taking platform that supports block-level reference and markdown-based content. Because it operates as a desktop client, it stores data locally in a database format, allowing users to organize information, link documents, and perform complex tasks like template-based calculations offline.

What does CWE-79 mean for CVE-2026-73043?

CWE-79 is the weakness class for Cross-Site Scripting (XSS). In the context of this vulnerability, the software fails to sanitize input within its template calculation operator. This allows malicious HTML and JavaScript to be injected into the system. Because the application processes these templates, the injected scripts can run with the elevated permissions of the desktop client's renderer, leading to unauthorized code execution.

How is the CVE-2026-73043 vulnerability triggered?

The vulnerability is triggered when a user opens a specially crafted database file containing malicious templates. Simply viewing the software interface or running the application normally does not trigger the bug; the attacker must successfully deliver and persuade a user to load a compromised database. Once the file is opened, the underlying template engine executes the injected code.

Do I need to worry about CVE-2026-73043 on my network?

According to Halo Surface Signal, this vulnerability is very unlikely to be exploited over the internet. The risk is localized because the flaw resides within the desktop client itself, rather than an internet-facing service or API. The threat is primarily relevant if your organization uses shared SiYuan databases from untrusted sources, which could expose individual workstations to malicious files.

How should I respond to this SiYuan vulnerability?

Your first step is to identify all systems where the SiYuan desktop client is installed. Once you have an inventory, verify if your users handle or share database files from external or untrusted sources. Since the vulnerability is specific to the template calculation feature in older versions, focus on ensuring that all desktop installations are updated to the secure version (v3.7.4 or later) to neutralize the risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.