THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-73044 (CRITICAL 9.0) — SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can inject malicious payloads through the setAttrViewColWidth API that break out of style attributes and inject even

[NVD] CVE-2026-73044 (CRITICAL 9.0) — SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can inject malicious payloads through the setAttrViewColWidth API that break out of style attributes and inject even

mednvdPublished 2026-08-15

CVE-2026-73044 CVSS: 9.0 CRITICAL Published: 2026-08-15T22:16:54.330

SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can inject malicious payloads through the setAttrViewColWidth API that break out of style attributes and inject event handlers on every table cell, executing arbitrar

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-73044