What is CVE-2026-73041?

CVE-2026-73041 is a critical-severity vulnerability in Siyuan-Note Siyuan, classified under Cross-site Scripting. CVSS score: 9.0/10. Published 2026-08-15.

How severe is CVE-2026-73041?

Critical severity. CVSS v3 base score is 9.0 out of 10.

XSS in Siyuan-Note Siyuan

CVE-2026-73041

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.

Vulnerability class: XSS (Cross-Site Scripting)

CVSS v3 metric

CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.

Affected products

Siyuan-note Siyuan — versions 0, 3.7.4

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-73041?: CVE-2026-73041 is a critical-severity vulnerability in Siyuan-Note Siyuan, classified under Cross-site Scripting. CVSS score: 9.0/10. Published 2026-08-15.
How severe is CVE-2026-73041?: Critical severity. CVSS v3 base score is 9.0 out of 10.