External risk intelligence

SiYuan Stored Cross-Site Scripting via Attribute View Field Names

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-73052

This vulnerability affects a desktop client application requiring user interaction to execute. It is not an internet-facing service, gateway, or network-accessible application, and typical usage is localized to the user's machine, making public network exposure of the vulnerable component highly unlikely.

Cross-site Scripting

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory describes a vulnerability in SiYuan where specially crafted field names could lead to arbitrary JavaScript execution, potentially allowing for code execution on the desktop client when Node integration is enabled. The core issue lies in how certain attribute-view field names are processed, allowing for markup injection.

Injected code exploits field renaming in a specific application.
Important to verify if this application is used internally.
Confirm relevance; potential for code execution if used.

Attack Path

How an attacker could exploit the issue

An attacker could target users of the SiYuan desktop client. By tricking a user into opening a specific sort menu after the attacker has renamed a database field, the attacker can inject malicious JavaScript. If the desktop client has Node integration enabled, this JavaScript could then be used to execute arbitrary code on the user's computer.

Requires authenticated user interaction.
User opens a sort menu.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

SiYuan's desktop client could allow attackers to execute arbitrary JavaScript when users open the sort menu, potentially leading to code execution when Node integration is enabled. This occurs when database field names are not properly escaped and are directly inserted into HTML option elements.

Arbitrary JavaScript execution.
User opens sort menu.
Code execution via Node integration.

Operational Fix

Recommended remediation, mitigation, and detection steps

SiYuan desktop client users with Node integration enabled are at risk from this stored cross-site scripting vulnerability. Application owners or system administrators are likely responsible for addressing this issue. The first practical step involves identifying all instances of SiYuan, determining which are business-critical, and confirming their reachability before planning remediation.

Application owners should manage remediation.
Verify Node integration and reachability first.
Plan user-initiated updates or vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SiYuan?

SiYuan is a local-first, open-source note-taking software that features block-based editing and a built-in database system. Users rely on it to organize information through attribute views, which allow for structured data management within their personal knowledge base.

What does CWE-79 mean for CVE-2026-73052?

CWE-79 refers to Improper Neutralization of Input During Web Page Generation, commonly known as Stored Cross-Site Scripting (XSS). In this case, SiYuan fails to clean text entered into database field names. Because the application treats this input as trusted code when displaying it in a menu, it inadvertently allows malicious scripts to run.

How is the vulnerability triggered?

An attacker must rename a database field to include malicious markup. The vulnerability is only triggered when a user manually opens the sort menu within the application. Simply viewing the database or having the malicious field present does not execute the code; the specific user action of opening that menu is required.

Is my SiYuan instance at risk?

According to Halo Surface Signal, this risk is very unlikely for most systems. Because SiYuan is a desktop client rather than a web-facing server, it is typically restricted to a local machine. It does not act as a gateway that attackers can reach over the internet, which significantly limits who can realistically attempt to exploit it.

What should I do if I use SiYuan?

Check if your desktop client has Node integration enabled, as this increases the severity of potential code execution. Prioritize updating the software to version 3.7.4 or later, which addresses the improper handling of field names. If an update is not immediately possible, limit who has permission to modify database field names.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.