CVE-2026-73041 is a critical cross-site scripting vulnerability in SiYuan note-taking software prior to version 3.7.4. The vulnerability stems from failure to properly validate or escape annotation fields written to disk via the setFileAnnotation endpoint. An attacker can inject malicious markup into these annotation fields, which executes as script in the PDF renderer component. This script execution occurs with full Node.js privileges when a user opens an annotated PDF, potentially allowing extensive system compromise. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required but user interaction needed, and high impact on confidentiality, integrity, availability, and security controls. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows attackers to execute arbitrary scripts with full Node.js access on the victim's system when opening an annotated PDF. This can lead to complete system compromise, data theft, or further malicious actions. The vulnerability affects confidentiality, integrity, availability, and security controls at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening annotated PDFs from untrusted sources in affected versions of SiYuan note-taking software. Monitor vendor channels for updates regarding patches or official mitigations.