Vulnerability · Published Aug 15, 2026 · Assigned by VulnCheck

CVE-2026-73044SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width

Critical 9.0

In plain English

A critical-severity cross-site scripting in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)9.0Critical

Exploit odds (30 days)0.4%top 62.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can inject malicious payloads through the setAttrViewColWidth API that break out of style attributes and inject event handlers on every table cell, executing arbitrary code in the Electron renderer with Node integration enabled.

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	0 – before 3.7.4

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-rj55-w3xr-gj62) vendor-advisory
VulnCheck Advisory: SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width third-party-advisory