Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-16 | 1 | Disclosure1 |
| 2026-08-27 | 1 | General1 |
🚨 CVE-2026-73041 - CVSS Score 9.4 (Critical): The PDF That Travels With Its Own RCE Five unescaped PDF annotation fields in SiYuan create a path from stored XSS to potential RCE. 🔗 Read full blog: https://secnora.com/blog/cve-2026-73041-siyuan-pdf-annotation-rce/
Post summary
The blog highlights a critical PDF RCE vulnerability in SiYuan via unescaped annotation fields, but no exploit code, patch, or active exploitation is mentioned.
CVE-2026-73041 SiYuan v3.7.4 Annotation Field Vulnerability Enables Script Execution https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-73041
Post summary
The post announces CVE-2026-73041, a script‑execution vulnerability in SiYuan v3.7.4’s annotation field, but offers no PoC, exploit code, or patch information.