CVE-2026-73047 is a server-side template injection vulnerability in siyuan-note's siyuan product affecting versions before 3.7.4. The attribute-view Template calculation feature introduced in version 3.7.0-beta.1 uses Sprig's unmodified function map, exposing functions that allow reading environment variables and performing DNS lookups. Because the kernel binds to 127.0.0.1 by default without per-UID access control, a local unauthenticated attacker can exploit this to access sensitive environment information from the account running siyuan, including from separate unprivileged OS accounts.

An attacker with local access to the system can exploit this vulnerability to read sensitive environment variables belonging to the user account running siyuan, potentially exposing confidential information. Additionally, the attacker can perform DNS lookups from the server's network position, which could be used for network reconnaissance or other indirect attacks. There is no indication of remote exploitation or privilege escalation beyond the account running siyuan.

A fix is available in siyuan version 3.7.4. Users should upgrade to version 3.7.4 or later to remediate this vulnerability. Since the vulnerability requires local access and exploitation involves injecting malicious template code, upgrading is the primary recommended mitigation.