CVE-2026-73047 is a server-side template injection vulnerability affecting siyuan-note's siyuan product in versions before 3.7.4. The attribute-view Template calculation feature introduced in v3.7.0-beta.1 uses Sprig's unmodified function map, which exposes functions such as env, expandenv, and getHostByName. An unauthenticated local attacker, leveraging the default binding of the kernel to 127.0.0.1 without per-UID access control, can inject malicious template formulas. This enables the attacker to read environment variables from the account running siyuan, including those of separate unprivileged OS accounts, and perform DNS lookups from the server's network position.

An attacker with local access to the server can exploit this vulnerability to disclose sensitive environment variables belonging to the account running siyuan, potentially including secrets or credentials. Additionally, the attacker can perform DNS lookups from the server, which may be used for reconnaissance or further attacks. The vulnerability does not require authentication and affects the confidentiality of environment data and network information.

A fix is available in siyuan version 3.7.4. Users should upgrade to version 3.7.4 or later to remediate this vulnerability. Since the vulnerability requires local access and exploits a specific template feature, upgrading the software is the recommended and effective mitigation.