CVE-2026-73053 is a critical cross-site scripting vulnerability in SiYuan note-taking software affecting versions prior to v3.7.4. The issue resides in the unicode2Emoji function, which improperly neutralizes input during web page generation by failing to sanitize codepoint branch output. Attackers can exploit this by crafting document icons containing hex-encoded markup that executes within the renderer process when Node integration is enabled, resulting in arbitrary code execution on the host system. The vulnerability has a CVSS 4.0 base score of 9.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, availability, and security requirements. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation allows an attacker to execute arbitrary code on the host system via crafted document icons in the SiYuan renderer with Node integration enabled. This can lead to full compromise of the affected system, impacting confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling Node integration in the renderer if possible and avoid opening untrusted documents containing custom icons.