CVE-2026-73042Disclosure

LOWCVSS 9.4 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitrary code via event handlers, reaching Node built-ins due to Electron's insecure configuration.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-73042

Full discourse1 post

Vulmon Vulnerability Feed@VulmonFeeds46d
Disclosure
CVE-2026-73042 Stored XSS and Arbitrary Code Execution in SiYuan Before v3.7.4 via Database Metadata https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-73042
Post summary
A short announcement discloses a stored XSS and arbitrary code execution vulnerability (CVE‑2026‑73042) in SiYuan version <3.7.4 via database metadata, with no PoC, exploit, or patch details provided.
00000144
4.1K followersView on X

Explore more

Back to dashboard