SiYuan < v3.7.4 Critical Vulnerability: Script Injection Risk
- Severity
- CRITICAL
- CVSS
- 9
- Affected component
- siyuan (npm)
- Patched version
- v3.7.4
SiYuan versions before v3.7.4 contain critical script injection vulnerabilities that allow remote code execution. Users of affected versions are at risk.
What happened
SiYuan versions before v3.7.4 fail to properly validate or escape user-provided input in several components, allowing attackers to inject malicious script that executes with full Node.js access when certain actions are performed. The setFileAnnotation endpoint, database menu metadata, and Template calculation operator are all affected. Attackers can inject markup that executes arbitrary code when users open annotated PDFs, group menus, or databases containing malicious templates.
The vulnerabilities have been assigned multiple CVE identifiers, all rated CRITICAL with CVSS scores between 9.0 and 9.8. The issues were first flagged and confirmed on August 15, 2026. No exploitation in the wild has been reported at this time.
What to do about it
- Upgrade to SiYuan v3.7.4 or later to mitigate the risk of script injection.
- Review your SiYuan installation and any user-provided content for signs of compromise.
- Monitor the primary sources for updates on the vulnerabilities and any additional patches that may be released.
How 0Day would have caught this
siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are running SiYuan version v3.7.3 or earlier, you are affected by these critical vulnerabilities.
What should I do right now?
Upgrade to SiYuan v3.7.4 or later immediately to mitigate the risk of remote code execution.
Have these vulnerabilities been exploited in the wild?
No exploitation in the wild has been reported at this time, according to the primary sources.