CVE-2026-73041 - SiYuan before v3.7.4 Remote Code Execution via PDF Annotations

Back Back to CVE browser

CRITICAL

SiYuan before v3.7.4 Remote Code Execution via PDF Annotations

Published Aug 15, 2026

9.4

CRITICAL

CVSS 4.0

EPSS 0.43%

Description

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.

Affected products

Vendor Siyuan-Note Product Siyuan Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <3.7.4
- Version
  3.7.4
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Siyuan-Note

Siyuan

unaffected

Version	Status	Constraints
0	affected	<3.7.4
3.7.4	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-59793
Advisory
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fqpw-c3pj-w8g9
exploitvendor-advisory
https://www.vulncheck.com/advisories/siyuan-before-remote-code-execution-via-pdf-annotations
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-59793		Advisory
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fqpw-c3pj-w8g9		exploitvendor-advisory
https://www.vulncheck.com/advisories/siyuan-before-remote-code-execution-via-pdf-annotations		third-party-advisory