Executive brief
siyuan is a note-taking and knowledge management application. The attribute-view Template calculation feature allows users to create custom formulas to summarize data in database columns. A local attacker without authentication can inject malicious formulas that expose environment variables (including credentials or secrets) and perform DNS lookups from the server's network position, potentially revealing sensitive information or enabling reconnaissance for further attacks.
Technical details
This is a server-side template injection (SSTI) vulnerability in the attribute-view Template calculation feature (kernel/av/calc_template.go). The templateFuncMap() function uses Sprig's unmodified TxtFuncMap() without removing the dangerous env, expandenv, and getHostByName functions—unlike BuiltInTemplateFuncs() which had these functions deleted for CVE-2024-55660 in 2024. The vulnerability is reachable locally without authentication (kernel binds to 127.0.0.1 with no per-UID access control) across all field types (Text, Number, Date, Select, MSelect, URL, Email, Phone, Block, MAsset, Created, Updated, Rollup). An attacker can inject a malicious template formula in a column definition to read environment variables belonging to the siyuan process—even from a separate unprivileged OS account—and perform DNS lookups. The payload persists in the attribute view's JSON configuration and re-executes on every document render. The vulnerability was introduced in v3.7.0-beta.1 and fixed in v3.7.4.
Affected products
- siyuan-note siyuan 3.7.0-beta.1 to 3.7.3
Timeline
- 2026-08-15: disclosed: CVE-2026-73047 published; GHSA-v97v-gxxg-rhmq advisory released
- 2026-08-15: patched: Fix available in v3.7.4
- 2024-12-11: other: CVE-2024-55660 fix (commit e70ed57f6) removed env, expandenv, getHostByName from BuiltInTemplateFuncs() but not from templateFuncMap()