CVE-2026-73050
CriticalCVSS 9.0Summary
SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary JavaScript when viewing databases containing the malicious select field.
Risk Assessment
An attacker can execute arbitrary JavaScript in the user's browser, potentially leading to data theft, session hijacking, or malicious actions within the application context.
Recommendation
Update SiYuan to version v3.7.4 or later, which includes a fix for validation and escaping of the color field in select options.
Original NVD description (English source)
SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary JavaScript when viewing databases containing the malicious select field.