THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-73053 (CRITICAL 9.0) — SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achievi

[NVD] CVE-2026-73053 (CRITICAL 9.0) — SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achievi

mednvdPublished 2026-08-15

CVE-2026-73053 CVSS: 9.0 CRITICAL Published: 2026-08-15T22:16:55.157

SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code execution on the host system.

Indicators of compromise

CVE-2026-73053cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-73053