CVE-2026-73041: Critical SiYuan Annotation Injection Grants Full Node.js Code Execution — Detection and Remediation Guide

NVD has published CVE-2026-73041, a CVSS 9.0 (CRITICAL), network-exploitable vulnerability affecting SiYuan, the popular open-source, Electron-based personal knowledge management application. SiYuan versions prior to v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation API endpoint. An attacker who can reach this endpoint can inject malicious markup into a PDF annotation; when a victim subsequently opens the annotated PDF, the payload executes as script inside the PDF renderer — with full Node.js access via the Electron runtime.

This is the nightmare scenario for Electron-based applications: what appears to be a benign client-side injection pivots directly into arbitrary code execution on the endpoint, because the renderer is not properly isolated from Node.js primitives. There is no sandbox between the injected markup and the operating system. Defenders running SiYuan — particularly teams using shared or synced workspaces, self-hosted SiYuan instances, or community plugin/serving configurations that expose the HTTP API — need to treat this as an urgent patch-and-hunt event.

Why This Matters to Defenders

Two characteristics make CVE-2026-73041 especially dangerous in real environments:

1. Network-reachable trigger. The vulnerable setFileAnnotation endpoint is part of SiYuan's HTTP API. In default local usage this binds to localhost, but SiYuan is frequently deployed in "serve mode" (Docker containers, self-hosted instances, LAN sharing) where the API is reachable across the network. An unauthenticated or weakly authenticated attacker can write a weaponized annotation into any PDF in the workspace without touching the victim's machine directly.

2. User-driven detonation with full privileges. The payload sits dormant in the annotation data until a user opens the PDF. At that moment it executes in the Electron renderer with Node.js integration, meaning the attacker inherits the full privileges of the SiYuan user — file system read/write, child process spawning, network egress. This is functionally equivalent to a document-based RCE, but the lure is a PDF inside the user's own trusted knowledge base, which defeats most user-suspicion heuristics.

Technical Analysis

Affected Products and Versions

How the Vulnerability Works

From a defender's perspective, the attack chain breaks down as follows:

1. Injection: The attacker sends a crafted request to SiYuan's setFileAnnotation endpoint, supplying annotation content containing malicious markup (script-bearing HTML/JS payloads) rather than legitimate annotation text.
2. Persistence on disk: Because the application fails to validate or escape the annotation fields, the malicious markup is written to disk as part of the annotation data associated with the target PDF. The payload survives application restarts and workspace syncs — meaning it can propagate to other users via SiYuan's sync mechanisms or shared hosting.
3. Execution: When a user opens the annotated PDF, SiYuan's built-in PDF renderer processes the annotation fields. The injected markup executes as script in the renderer context.
4. Node.js pivot: Because the Electron renderer in affected versions exposes Node.js primitives, the executing script can call require('child_process'), read/write arbitrary files, enumerate the file system, and establish outbound connections — a complete endpoint compromise under the user's security context.

Exploitation Requirements and Status

• Exploitation prerequisites: Network access to the SiYuan HTTP API (trivially satisfied on self-hosted/serve-mode deployments) and a victim user who subsequently opens the poisoned PDF. Authentication posture depends on deployment configuration; many self-hosted instances run with the default authorization token or weak tokens.
• In-the-wild status: At the time of publication, CVE-2026-73041 is newly published by NVD. There are no confirmed in-the-wild exploitation reports or CISA KEV listing yet — but given the low complexity, the public technical description, and the popularity of SiYuan in developer and research communities, defenders should assume working exploit code will surface quickly. Treat this as pre-weaponization and compress your patch window accordingly.
• Blast radius: Any synced/shared workspace means a single poisoned annotation can detonate across an entire team's endpoints. Consider this when scoping incident response.

Detection & Response

The highest-fidelity detection strategy focuses on the post-exploitation behavior: the SiYuan/Electron process spawning unexpected child processes. Legitimate SiYuan usage does not require the application to spawn shells, script interpreters, or download tools. That behavioral pivot is your strongest signal.

Sigma Rules

---
title: SiYuan Electron Process Spawning Shell or Script Interpreter
description: Detects the SiYuan desktop application spawning command shells, script interpreters, or living-off-the-land binaries — consistent with CVE-2026-73041 annotation injection executing with Node.js child_process access.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73041
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
id: 8c2f4a17-3b9e-4d51-9f6a-2e7c1d5b8a03
status: experimental
tags:
  - attack.execution
  - attack.t1059
  - cve.2026.73041
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\SiYuan.exe'
      - '\siyuan.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate plugin activity; baseline plugin behavior before tuning
level: high
---
title: SiYuan Spawning Shell on Linux or macOS
description: Detects SiYuan spawning shells or interpreters on Linux/macOS — post-exploitation indicator for CVE-2026-73041 Node.js renderer escape.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73041
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/06
id: 3f7b9e24-6a1d-4c82-b5e0-9d4a2c8f7b16
status: experimental
tags:
  - attack.execution
  - attack.t1059.004
  - cve.2026.73041
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'siyuan'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/zsh'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Community plugin execution of system commands; audit installed plugins
level: high
---
title: SiYuan Network Connection to Uncommon External Destination
description: Detects the SiYuan process establishing outbound connections to non-sync infrastructure, consistent with post-exploitation C2 or data staging after CVE-2026-73041 execution.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73041
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
id: 5e1d8c36-9f4a-4b73-a2c8-7d3e5f1a9b42
status: experimental
tags:
  - attack.command_and_control
  - attack.t1071
  - cve.2026.73041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\SiYuan.exe'
      - '\siyuan.exe'
    Initiated: 'true'
  filter_sync:
    DestinationHostname|contains:
      - 'siyuan'
      - 'b3log'
      - 'ld246'
  filter_local:
    DestinationIp|startswith:
      - '127.'
      - '10.'
      - '172.16.'
      - '192.168.'
  condition: selection and not 1 of filter_*
falsepositives:
  - Third-party cloud sync endpoints configured by the user; document and allowlist known sync providers
level: medium

KQL Hunt — Microsoft Sentinel / Defender

Use this query to hunt across your estate for SiYuan spawning suspicious child processes, and to identify any hosts still running a vulnerable build. Run it over a 14–30 day lookback to catch dormant detonations.

// Hunt 1: SiYuan spawning shells, interpreters, or LOLBins (post-exploitation of CVE-2026-73041)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "SiYuan.exe" or InitiatingProcessFileName =~ "siyuan" or InitiatingProcessFolderPath has "siyuan"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","certutil.exe","bitsadmin.exe","curl.exe","wmic.exe","sh","bash","zsh","python","python3","perl","wget","nc")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ReportId
| sort by TimeGenerated desc
;
// Hunt 2: Inventory hosts running SiYuan for patch scoping (any version present = verify against v3.7.4)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "SiYuan.exe" or FolderPath has "siyuan"
| summarize LastSeen = max(TimeGenerated), Versions = make_set(FileVersion) by DeviceName, FolderPath
| sort by LastSeen desc

Velociraptor VQL Hunt

This artifact collects live SiYuan process trees and their children across endpoints — ideal for rapid triage when you suspect a poisoned PDF has detonated in a synced workspace.

-- Hunt for SiYuan processes and any spawned children (CVE-2026-73041 post-exploitation triage)
LET siyuan = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)siyuan' OR Exe =~ '(?i)siyuan'

LET children = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid in (SELECT Pid FROM pslist() WHERE Name =~ '(?i)siyuan')

SELECT 'parent' AS Role, Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime FROM siyuan
UNION ALL
SELECT 'child' AS Role, Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime FROM children

Version Verification and Remediation Script

Use this script to identify vulnerable SiYuan installations on Windows endpoints, flag versions below v3.7.4, and check whether the HTTP API is exposed beyond localhost (a key exploitation prerequisite).

# CVE-2026-73041 — SiYuan vulnerable version detection and API exposure check
$fixedVersion = [version]"3.7.4"
$report = @()

# Locate SiYuan installations (per-user and system-wide paths)
$installPaths = @(
    "$env:LOCALAPPDATA\Programs\SiYuan",
    "$env:ProgramFiles\SiYuan",
    "${env:ProgramFiles(x86)}\SiYuan"
)

foreach ($path in $installPaths) {
    $exe = Join-Path $path "SiYuan.exe"
    if (Test-Path $exe) {
        $ver = [version](Get-Item $exe).VersionInfo.ProductVersion
        $status = if ($ver -lt $fixedVersion) { "VULNERABLE — upgrade to v3.7.4+" } else { "Patched" }
        $report += [PSCustomObject]@{ Host=$env:COMPUTERNAME; Path=$exe; Version=$ver; Status=$status }
    }
}

# Check for running SiYuan and whether its API is bound beyond localhost
$siyuanProc = Get-Process -Name "SiYuan" -ErrorAction SilentlyContinue
if ($siyuanProc) {
    $listeners = Get-NetTCPConnection -State Listen -OwningProcess $siyuanProc.Id -ErrorAction SilentlyContinue
    foreach ($l in $listeners) {
        if ($l.LocalAddress -notin @("127.0.0.1","::1")) {
            $report += [PSCustomObject]@{ Host=$env:COMPUTERNAME; Path="NETWORK-EXPOSED API"; Version="Port $($l.LocalPort) on $($l.LocalAddress)"; Status="HIGH RISK — restrict API binding or firewall immediately" }
        }
    }
}

$report | Format-Table -AutoSize
if ($report.Status -match "VULNERABLE|HIGH RISK") { exit 1 } else { exit 0 }

Remediation

1. Patch immediately. Upgrade all SiYuan desktop clients and self-hosted instances to v3.7.4 or later. Pull the release from the official repository (github.com/siyuan-note/siyuan/releases) or update Docker images if running in serve mode. Do not rely on auto-update alone for managed fleets — push the package through your software deployment tooling.
2. Restrict the HTTP API. Until patched — and as a permanent hardening measure — ensure the SiYuan API binds only to 127.0.0.1. For self-hosted/Docker deployments, place the instance behind an authenticated reverse proxy, restrict source IPs at the firewall, and rotate the authorization token. A default or leaked token turns this CVE into unauthenticated remote exploitation.
3. Audit synced workspaces. Because poisoned annotations persist on disk and propagate through sync, patching the client does not remove an already-planted payload. If you suspect exposure (API reachable from untrusted networks, shared workspaces with external collaborators), review recently modified PDF annotation data for unexpected markup and consider restoring PDFs from known-good backups.
4. Hunt retrospectively. Run the KQL inventory and child-process hunts above across at least a 30-day window. Any SiYuan process spawning a shell, script interpreter, or download utility is a high-confidence compromise indicator — isolate the host, capture memory, and scope lateral movement, since the attacker inherits the user's full privileges.
5. Treat PDFs in the knowledge base as untrusted content. Until the fleet is patched, warn users against opening annotated PDFs in shared workspaces from untrusted sources, and consider temporarily disabling PDF annotation features via workspace policy where operationally feasible.
6. Apply Electron hygiene broadly. If your environment runs other Electron applications, use this event to review renderer hardening posture (Node integration disabled, context isolation enabled, sandboxed renderers). CVE-2026-73041 is a textbook example of why renderer-to-Node bridges are a critical attack surface.

Monitor the NVD entry for CVE-2026-73041 and the SiYuan GitHub security advisories for updates, including any CISA KEV addition that would impose federal remediation deadlines and signal confirmed exploitation.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub