Overview
A critical remote code execution (RCE) vulnerability has been disclosed in SiYuan, the popular open-source personal knowledge management and note-taking application. Tracked as CVE-2026-73043 with a CVSS score of 9.0, the flaw exists in SiYuan's Template calculation operator, which renders user-authored Go templates but stores their output verbatim without any sanitization.
Attackers who can craft or share malicious notes can inject arbitrary HTML and JavaScript into template calculation blocks. This script then executes in SiYuan's Electron-based renderer — a context that carries full Node.js API access, enabling arbitrary code execution on the victim's machine.
Technical Details
SiYuan's Template block feature allows users to embed Go text/template expressions directly inside note content. The vulnerability arises from a design-level oversight: rendered template output is written to the document DOM without HTML encoding or Content Security Policy (CSP) restrictions effective enough to block inline script execution.
Attack vector:
- An attacker creates a SiYuan note containing a malicious Template block, e.g., embedding
<script>payloads or abusing Go template logic to emit event-handler attributes. - The victim opens or syncs the note. SiYuan's backend renders the Go template and inserts raw HTML output into the document.
- Script executes in the Electron context with full
require('node:...')access — enabling file system reads/writes, process spawning, and network exfiltration.
This is particularly dangerous for teams using SiYuan's workspace sync or shared workspace features, as a single malicious contributor can silently target all syncing users.
Affected Versions
All SiYuan releases prior to v3.7.4 are vulnerable. The CVE was published to the NVD on August 15, 2026.
Mitigation
- Upgrade immediately to SiYuan v3.7.4 or later, which sanitizes template output before DOM insertion.
- Until patched, avoid opening notes from untrusted sources, syncing with untrusted workspaces, or importing exported SiYuan packages from unknown parties.
- Enterprise users should consider restricting SiYuan network access and auditing existing workspaces for suspicious template blocks.