CVE-2026-73041

CriticalCVSS 9.0/10Last modified Aug 26, 2026

Description

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 15, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-730429.0SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when us CVE-2026-730439.0SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authore CVE-2026-730449.0SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into styl CVE-2026-730457.5SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoin CVE-2026-730469.8SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication bra CVE-2026-730476.2siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation CVE-2026-730485.8SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block CVE-2026-730495.8SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the fo CVE-2026-73056.3A weakness has been identified in Xuxueli xxl-job up to 3.3.2. The affected element is the function triggerJob of the file xxl-job-admin/src CVE-2026-730509.0SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site script CVE-2026-730516.3actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Con CVE-2026-730529.0SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHT