SiYuan v3.7.4 Critical Vulnerability: Stored XSS in Style Attributes
- Severity
- CRITICAL
- CVSS
- 9
- Affected component
- cve-2026-73044 (npm)
- Patched version
- v3.7.4
SiYuan versions before v3.7.4 reportedly have a critical vulnerability that allows stored cross-site scripting attacks. Users of these versions are potentially affected.
What happened
SiYuan versions before v3.7.4 fail to validate or escape table column width values, which allows stored cross-site scripting injection into style attributes. Attackers can exploit this by injecting malicious payloads through the setAttrViewColWidth API. This can result in the injection of event handlers on every table cell, leading to the execution of arbitrary code in the Electron renderer with Node integration enabled.
The vulnerability has been assigned CVE-2026-73044 with a CVSS score of 9.0, indicating a critical severity level. The issue was first flagged on 2026-08-15T22:16:54.330000+00:00. To assess your exposure, check if you are using a version of SiYuan before v3.7.4.
What to do about it
- Upgrade to SiYuan v3.7.4 or later to mitigate the risk of stored cross-site scripting attacks.
- Review your application for any instances where the setAttrViewColWidth API is used and ensure proper validation and escaping of input values.
- Monitor the NVD page for CVE-2026-73044 for any updates or additional information related to this vulnerability.
How 0Day would have caught this
cve-2026-73044 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using SiYuan versions before v3.7.4, you are potentially affected by this vulnerability.
What should I do right now?
Upgrade to SiYuan v3.7.4 or later to mitigate the risk of stored cross-site scripting attacks.
Is there an official fix available?
Yes, SiYuan v3.7.4 is the patched version that addresses this vulnerability.