by Kastro
Paper/Archive/CVE-2026-73041

CVE-2026-73041

siyuan-note siyuan — SiYuan before v3.7.4 Remote Code Execution via PDF Annotations

EPSS 0.4%public exploitCVSS 9.4
critical.is priorityof 100
46
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 37.1.371 × 207.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.

Affected

ProductAffectedFixed inSource
siyuan< 3.7.43.7.4CNA

Scores by source

VulnCheck (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
VulnCheck (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/siyuan-note/siyuan/security/advisories/GHSA-fqpw-c3pj-w8g9writeupvulncheck.com/advisories/siyuan-before-remote-code-execution-via-pdf-annotations