NPM · AUGUST 2026 · CONFIRMED

SiYuan < v3.7.4 Critical Vulnerability: Script Injection Risk

Severity
CRITICAL
CVSS
9
Affected component
siyuan (npm)
Patched version
v3.7.4
CVE-2026-73041

SiYuan versions before v3.7.4 contain critical script injection vulnerabilities that allow remote code execution. Users of affected versions are at risk.

What happened

SiYuan versions before v3.7.4 fail to properly validate or escape user-provided input in several components, allowing attackers to inject malicious script that executes with full Node.js access when certain actions are performed. The setFileAnnotation endpoint, database menu metadata, and Template calculation operator are all affected. Attackers can inject markup that executes arbitrary code when users open annotated PDFs, group menus, or databases containing malicious templates.

The vulnerabilities have been assigned multiple CVE identifiers, all rated CRITICAL with CVSS scores between 9.0 and 9.8. The issues were first flagged and confirmed on August 15, 2026. No exploitation in the wild has been reported at this time.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are running SiYuan version v3.7.3 or earlier, you are affected by these critical vulnerabilities.

What should I do right now?

Upgrade to SiYuan v3.7.4 or later immediately to mitigate the risk of remote code execution.

Have these vulnerabilities been exploited in the wild?

No exploitation in the wild has been reported at this time, according to the primary sources.

Sources

Join the 0Day waitlist →

← Back to all threats