Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code execution on the host system.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-15 | 2 | Disclosure1General1 |
| 2026-08-16 | 1 | Disclosure1 |
CVE-2026-73053 SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can… https://www.cve.org/CVERecord?id=CVE-2026-73053
Post summary
The post describes a cross‑site scripting vulnerability in SiYuan’s unicode2Emoji function in versions prior to 3.7.4, noting how attackers can exploit it.
CVE-2026-73053 SiYuan v3.7.4 Cross-Site Scripting Enables Arbitrary Code Execution https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-73053
Post summary
The post announces CVE‑2026‑73053 as an XSS vulnerability in SiYuan v3.7.4 that allows arbitrary code execution, but it provides no PoC, exploit, patch, or evidence of active exploitation.
🚨*CVE* CVE-2026-73053 SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can… https://www.cve.org/CVERecord?id=CVE-2026-73053 ----- Traducción: CVE-2026-73053 SiY… https://infoflow.cloud`
Post summary
The tweet announces a newly disclosed XSS vulnerability in SiYuan’s unicode2Emoji function with affected versions and no evidence of exploitation or available fix.