Ghostwire

CVE-2026-73041: SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation...

CRITICAL CVSS 9.0 Exploit Available

Published: August 15, 2026 | Last Modified: August 15, 2026

Description

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.

Ghostwire Analysis — What This Means Practically

Critical CVSS score indicates maximum severity — remote code execution, authentication bypass, or complete system compromise is likely possible.
Exploit code is reported to be available, increasing the likelihood of active exploitation.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

References

github.com/siyuan-note/siyuan/security/advisories/GHSA-fqpw-c3pj-w8g9
www.vulncheck.com/advisories/siyuan-before-remote-code-execution-via-pdf-annotat
www.tenable.com/cve/CVE-2026-73041
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-73041