CVE-2026-73043 in SiYuan
Summary
by MITRE • 08/15/2026
SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in the desktop client renderer with Node integration enabled, allowing arbitrary code execution when the database is opened.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/16/2026
This vulnerability exists within SiYuan's template processing functionality where the application fails to properly sanitize user input before rendering Go templates. The flaw specifically affects versions prior to v3.7.4 and represents a critical security weakness that enables remote code execution through template manipulation. When users create or modify templates containing malicious code, the system executes these templates without proper sanitization, allowing attackers to inject harmful content that gets rendered verbatim within the desktop client environment.
The technical implementation of this vulnerability stems from the application's use of Node integration within its desktop client renderer, which provides direct access to system resources and capabilities. This design choice creates a dangerous execution environment where untrusted template content can be processed with elevated privileges. The vulnerability operates at the intersection of template injection and code execution, specifically targeting the Go templating engine used by SiYuan's rendering system. Attackers exploit this weakness by crafting malicious templates that contain HTML and JavaScript payloads designed to execute within the desktop client's Node.js environment.
The operational impact of this vulnerability is severe and far-reaching, as it allows attackers to achieve arbitrary code execution on affected systems with minimal user interaction required. Simply opening a compromised database file containing the malicious template will trigger the exploit, making it particularly dangerous for collaborative environments where multiple users may access shared databases. This vulnerability can be leveraged to install malware, steal sensitive information, compromise system integrity, or establish persistent access to target machines. The attack surface is expanded by the fact that the vulnerability affects the desktop client rendering process, meaning even database files created on other systems could contain malicious templates when opened locally.
The underlying technical flaw aligns with CWE-94, which describes weaknesses in the code execution of externally-influenced code, and demonstrates how template injection can lead to arbitrary code execution. From an ATT&CK perspective, this vulnerability maps to T1059.006 for Command and Scripting Interpreter and T1203 for Exploitation for Client Execution, as attackers can leverage the desktop client's Node.js environment to execute malicious commands. The vulnerability also relates to T1546.001 for System Scripting and T1566.001 for Phishing, since attackers could craft malicious templates that appear legitimate within the application interface.
Mitigation strategies should focus on immediate version updates to v3.7.4 or later, which addresses this specific vulnerability through proper template sanitization and input validation. Organizations should implement strict template review processes and restrict user permissions when creating or modifying templates within SiYuan environments. Network-level controls including web application firewalls and content filtering can help detect and block malicious template content before it reaches affected systems. Additionally, security awareness training should emphasize the dangers of opening untrusted database files and encourage users to verify template integrity before use. Regular security assessments and vulnerability scanning should be implemented to identify similar issues in other applications utilizing similar template processing frameworks, ensuring comprehensive protection against similar exploitation vectors across the organization's technology stack.