THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-73047 (MEDIUM 6.2) — siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduced in v3.7.0-beta.1). The feature's template engine uses Sprig's unmodified function map, which still exposes the env, exp

[NVD] CVE-2026-73047 (MEDIUM 6.2) — siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduced in v3.7.0-beta.1). The feature's template engine uses Sprig's unmodified function map, which still exposes the env, exp

mednvdPublished 2026-08-15

CVE-2026-73047 CVSS: 6.2 MEDIUM Published: 2026-08-15T22:16:54.737

siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduced in v3.7.0-beta.1). The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and getHostByName functions that were remove

MITRE ATT&CK techniques

Template InjectionT1221

Indicators of compromise

CVE-2026-73047cve
CVE-2024-55660cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-73047