CVE-2026-73044 is a critical stored cross-site scripting vulnerability in SiYuan note-taking software versions prior to v3.7.4. The vulnerability arises because the application fails to properly validate or escape input for table column width values, allowing attackers to inject malicious payloads into style attributes. These payloads can break out of the style context and inject event handlers on every table cell. Because SiYuan runs in an Electron environment with Node integration enabled, successful exploitation can lead to arbitrary code execution within the renderer process.

Exploitation of this vulnerability can lead to arbitrary code execution in the Electron renderer process, potentially allowing attackers to execute malicious code with the privileges of the application user. This can compromise the confidentiality, integrity, and availability of the affected system and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor for an official fix from the SiYuan project and apply it promptly once available. Until then, avoid using untrusted input in table column width settings or disable Node integration in the Electron environment if possible.