External risk intelligence

SiYuan Stored Cross-Site Scripting via Column Width API

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-73044

SiYuan is a local-first personal knowledge management application typically run as a desktop client or locally hosted service. It is not designed as an internet-facing edge service or public-facing web application, making widespread public internet exposure and reachability for this specific vulnerability very unlikely.

Cross-site Scripting

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in SiYuan software that could allow for the injection of malicious code when handling table column width values. This issue impacts how the software processes specific data inputs, potentially leading to the execution of arbitrary commands within the application's environment if exploited through user interaction.

Unchecked data allows code execution.
It affects user interaction with tables.
Confirm if this software is in use.

Attack Path

How an attacker could exploit the issue

An attacker with low-privileged access can inject malicious code into table column widths by leveraging the setAttrViewColWidth API. This injection allows for stored cross-site scripting, enabling the execution of arbitrary code within the application's renderer process when a user interacts with a modified table.

Requires authenticated access.
Inject code via table column width API.
Arbitrary code execution in renderer.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow attackers to inject malicious code into SiYuan tables when an authenticated user with low privileges views specially crafted content. This could lead to the execution of arbitrary code within the Electron renderer process with Node integration enabled.

Table data could be compromised.
Malicious code could execute in the renderer.
Arbitrary code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The SiYuan application's desktop client or locally hosted service requires identification by asset owners to determine reachability and business criticality. Platform teams or application owners should lead remediation efforts, coordinating with security teams for exposure assessment and vendor management for potential fixes.

Identify accountable application owners.
Verify reachability and business criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SiYuan software?

SiYuan is a local-first personal knowledge management application. Users typically run it as a desktop client or a locally hosted service to organize notes, documents, and data. Because it focuses on individual or small-team knowledge storage, it is generally used in private environments rather than as a public-facing web platform.

What is the vulnerability in CVE-2026-73044?

This vulnerability is a type of Stored Cross-Site Scripting (CWE-79). It occurs because SiYuan fails to properly check or sanitize the data used for table column widths. An attacker can input malicious script code into these width values, which the application then stores. When another user views the affected table, the stored script can execute, potentially running unauthorized code within the application's environment.

How can an attacker trigger this vulnerability?

An attacker must have authenticated, low-privileged access to the application to use the setAttrViewColWidth API. By sending a crafted payload through this API, they inject malicious code into a table's configuration. Note that simply viewing a normal table without these specific malicious modifications does not trigger the bug; the exploit relies on the presence of the injected code within the table's attributes.

Do I need to worry about internet exposure?

According to Halo Surface Signal, widespread internet reachability for this vulnerability is very unlikely. Since SiYuan is typically deployed as a local desktop client or a private service, it is not designed to be an edge service exposed to the open internet. Your primary risk is usually internal, where an authenticated user with access to the application could potentially trigger the issue.

What is the first step to address this issue?

Your first step should be identifying where SiYuan is deployed across your organization to confirm if you are running a version before v3.7.4. Once identified, evaluate who has access to the application, as the flaw requires authenticated interaction. Coordinate with your application owners to plan an update to a patched version once available, as this is the primary way to fix the underlying input validation failure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.