CVE-2026-74902 describes a cross-site scripting vulnerability in SiYuan note-taking software prior to version 3.7.4. The flaw exists in the file upload validation flow where filenames are inserted into HTML without proper escaping via insertAdjacentHTML. An attacker can exploit this by creating a malicious filename containing script code. When a user drags, drops, or pastes such a file into the editor, the script executes with high privileges, including full OS command access. This vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity. No official remediation or patch information is currently available.

Successful exploitation allows an attacker to execute arbitrary scripts with full OS command access on the victim's system when interacting with maliciously named files in the editor. This can lead to complete compromise of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid dragging, dropping, or pasting files with untrusted or suspicious filenames into the SiYuan editor to mitigate risk.