CVE-2026-74902
HighCVSS 8.6Summary
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access when a user drags, drops, or pastes the file into the editor.
Risk Assessment
The risk involves execution of malicious scripts in the user's context, potentially leading to account takeover, data theft, or full system compromise.
Recommendation
Update SiYuan to version v3.7.4 or later and implement proper filename escaping in the user interface.
Original NVD description (English source)
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access when a user drags, drops, or pastes the file into the editor.