CVE-2026-73044 in SiYuan
Summary
by MITRE • 08/15/2026
SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can inject malicious payloads through the setAttrViewColWidth API that break out of style attributes and inject event handlers on every table cell, executing arbitrary code in the Electron renderer with Node integration enabled.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/16/2026
The vulnerability in SiYuan versions prior to v3.7.4 represents a critical stored cross-site scripting flaw that exploits improper input validation within the table column width handling mechanism. This weakness allows attackers to inject malicious payloads through the setAttrViewColWidth API endpoint, which directly manipulates style attributes associated with table cells. The root cause lies in the application's failure to properly sanitize or escape user-supplied column width values before incorporating them into HTML output, creating an environment where attacker-controlled data can be interpreted as executable code within the browser context.
The technical implementation of this vulnerability leverages the Electron framework's renderer process execution model combined with Node.js integration capabilities. When attackers inject malicious payloads through the vulnerable API, these inputs are stored and subsequently rendered in table cell style attributes without proper sanitization. The injection breaks out of the intended style attribute context and injects event handlers that execute arbitrary JavaScript code within the Electron renderer environment. This exploitation vector is particularly dangerous because it enables full code execution with the privileges of the Node.js integration layer, potentially allowing attackers to access system resources, read/write files, or establish persistence mechanisms.
The operational impact of this vulnerability extends beyond traditional web application attacks due to the Electron-based architecture of SiYuan. Attackers can leverage this flaw to compromise the entire application environment, as the renderer process with Node integration enabled operates with elevated privileges that can bypass standard browser security restrictions. The stored nature of the vulnerability means that once an attacker successfully injects malicious code, it persists and executes automatically whenever affected tables are rendered, potentially affecting all users who view the compromised content. This makes the vulnerability particularly dangerous in collaborative environments where multiple users may be exposed to the same malicious content.
Security mitigations for this vulnerability require immediate implementation of proper input validation and output sanitization measures within the application's table rendering logic. The fix must ensure that all user-supplied column width values are properly escaped or validated before being incorporated into style attributes, preventing any possibility of code injection through the setAttrViewColWidth API. Organizations should also consider implementing Content Security Policy headers to limit script execution capabilities and disable unnecessary Node.js integration in the renderer process where possible. The vulnerability aligns with CWE-79 (Cross-site Scripting) and represents a specific implementation weakness that maps to attack techniques described in the MITRE ATT&CK framework under web application exploitation categories, particularly those targeting Electron-based applications where renderer privilege escalation can lead to complete system compromise.