Originally published at HOL
BREAKING: CVE-2026-73043 - SiYuan Template Calculation RCE in the Desktop Client
TL;DR: SiYuan versions before 3.7.4 can turn a low-privilege database Template calculation into arbitrary operating-system command execution in the desktop application. The server renders attacker-authored text/template output and stores it verbatim. The desktop renderer later inserts that string through innerHTML without the sanitizer already used by SiYuan's equivalent template-column path. Because the Electron client runs with Node integration enabled, script execution in the renderer can reach Node built-ins such as child_process. CVE-2026-73043 is CVSS 9.0 Critical under CVSS 3.1 and 9.4 Critical under CVSS 4.0. Upgrade to SiYuan 3.7.4 or later. The current stable release is 3.8.0.
The vulnerable path
The flaw sits in SiYuan's database calculation feature. A user can configure a Template calculation for a database field. On the server, SiYuan executes the template using Go's text/template package and stores the rendered result as a plain text value.
text/template does not perform HTML-context escaping. That is expected behavior for the library, but it becomes dangerous when the rendered output is later treated as trusted markup.
The advisory identifies the client-side sink in the database renderer. The Template calculation result falls back to the raw content string and is interpolated into a <span>. The resulting HTML is then assigned through innerHTML. SiYuan already has getAVTemplateHTML(), a helper that runs equivalent template-column output through DOMPurify, but the calculation path does not call it.
The attacker does not need a template-function injection trick. Literal markup in the template body is enough. A simple event-handler payload can survive the server-side rendering step and arrive at the desktop client as active HTML.
From HTML execution to OS commands
In an ordinary browser, this would be a serious stored cross-site scripting issue. In SiYuan's desktop application, the impact is larger because the Electron renderer is configured with Node integration enabled and context isolation disabled. Script that executes in the renderer can access Node.js capabilities, including process execution.
The CVE record reflects that cross-boundary impact. CVSS 3.1 scores the issue at 9.0 Critical with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. CVSS 4.0 scores it at 9.4 Critical. The attacker needs low privileges to author the calculation, and the victim interaction is simply opening a view that renders the malicious calculation footer.
Affected and fixed versions
The CVE record marks SiYuan versions before 3.7.4 as affected and 3.7.4 as fixed. SiYuan released 3.8.0 on August 12, 2026, and that release includes the newer AI Agent and Model Context Protocol functionality. For operators already updating, 3.8.0 or later is the clearest current stable target.
What to do
Upgrade immediately. Desktop and mobile users should install SiYuan 3.8.0 or later through their normal distribution channel.
Docker operators who pin versions can move to the current stable image:
docker pull b3log/siyuan:v3.8.0
Then update the Compose or deployment manifest and recreate the service using the normal change process.
If you manage shared workspaces, review who can create or modify database Template calculations. Until every client is patched, do not treat restricted authoring rights as a complete mitigation. A malicious database can also reach users through shared workspaces, synchronization, import, or distributed packages.
Detection and review
Look for unexpected Template calculations in database configuration, especially values containing HTML elements, inline event handlers, script-adjacent attributes, or strings referencing Node/Electron primitives. If an affected desktop client rendered an untrusted calculation, review host telemetry for unexpected child processes launched by the SiYuan Electron process and inspect recent workspace changes for persistence.
This is separate from CVE-2026-73046, the SiYuan HTTP Basic Auth lockout bypass. Both issues are fixed by moving beyond the vulnerable pre-3.7.4 line, but they affect different trust boundaries.
