CVE-2026-73053: SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji
SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code execution on the host system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.7.4 - Configuration
Disable Node integration to prevent document icon hex-encoded markup from executing in the renderer and achieving arbitrary code execution on the host system.
SiYuan Node integration = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73053?
CVE-2026-73053 has a severity rating of critical, with a score of 9.
How do I fix CVE-2026-73053?
To fix CVE-2026-73053, upgrade SiYuan to version 3.7.4 or later.
What type of vulnerability is CVE-2026-73053?
CVE-2026-73053 is classified as a Cross-Site Scripting (XSS) vulnerability.
What versions of SiYuan are affected by CVE-2026-73053?
SiYuan versions prior to 3.7.4 are affected by CVE-2026-73053.
What exploit capabilities does CVE-2026-73053 provide to attackers?
CVE-2026-73053 allows attackers to execute arbitrary code in the renderer when Node integration is enabled.