{"apiVersion":"1.0","identifier":"CVE-2026-73047","description":"siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduced in v3.7.0-beta.1). The feature-s template engine uses Sprig-s unmodified function map, which still exposes the env, expandenv, and getHostByName functions that were removed elsewhere for CVE-2024-55660. A local, unauthenticated attacker (the kernel binds to 127.0.0.1 by default with no per-UID access control) can inject a malicious Template calculation formula to read environment variables belonging to the account running siyuan — including from a separate, unprivileged OS account — and to perform DNS lookups from the server-s network position.","publishedAt":"2026-08-15T22:16:54","lastModifiedAt":"2026-08-26T16:57:52","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73047","cvssScore":6.2,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","epssProbability":0.00133,"riskScore":0.63,"affectedProduct":"siyuan","affectedVersions":"<=3.7.3","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-73047","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-73047","en":"https://www.redsauce.net/en/cves/CVE-2026-73047","fr":"https://www.redsauce.net/fr/cves/CVE-2026-73047","pt":"https://www.redsauce.net/pt/cves/CVE-2026-73047","de":"https://www.redsauce.net/de/cves/CVE-2026-73047","sk":"https://www.redsauce.net/sk/cves/CVE-2026-73047","el":"https://www.redsauce.net/el/cves/CVE-2026-73047"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-73047"}}