CVE-2026-73044 is a critical stored cross-site scripting vulnerability in SiYuan note-taking software versions prior to v3.7.4. The vulnerability arises because the application fails to properly validate or escape input for table column width values. Attackers can exploit this by injecting malicious payloads through the setAttrViewColWidth API, which break out of style attributes and inject event handlers into every table cell. This results in arbitrary code execution within the Electron renderer process, which has Node integration enabled, increasing the potential impact.

Successful exploitation allows an attacker with at least low privileges to execute arbitrary code in the context of the Electron renderer process. This can lead to full compromise of the affected application environment, as the injected code can leverage Node integration to perform actions beyond typical web sandbox restrictions. The vulnerability has a CVSS 4.0 score of 9.4, indicating critical severity with high impact on confidentiality, integrity, and availability.

No official patch or remediation is currently confirmed for this vulnerability. Users should monitor the vendor's advisories for updates and apply any official fixes once available. Until then, avoid using untrusted input with the setAttrViewColWidth API or restrict access to trusted users only. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.