CVE-2026-73044
SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can inject malicious payloads through the setAttrViewColWidth API that break out of style attributes and inject event handlers on every table cell, executing arbitrary code in the Electron renderer with Node integration enabled.
- Affected products
- Siyuan
- Fix
- Available
- CVSS 4.0
- 9.4 CRITICAL
- CVSS 3.1
- 9.0 CRITICAL
- EPSS
- 0.2% (16th percentile)
- Weakness
- CWE-79
- NVD status
- Received
- Published
- 2026-08-15
CVE-2026-73044 at NVD
No indexed exploits for CVE-2026-73044 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-73044 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.