A critical stored cross-site scripting flaw in the SiYuan note-taking application lets a low-privileged user plant arbitrary JavaScript in a database select option's color field, executing whenever another user views the affected database.
What Is It
CVE-2026-73050 is a stored cross-site scripting vulnerability (CWE-79) in SiYuan versions before v3.7.4. The application fails to validate or escape the color field in attribute-view select options. Because that value reaches eight separate render sites unescaped, an attacker who includes quotation marks in the color value can break out of the intended attribute context and inject event-handler attributes. The injected JavaScript executes when a user opens a database containing the malicious select field.
Why It Matters
The flaw carries a CVSS 3.1 base score of 9.0 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, network-reachable, low attack complexity, only low privileges needed, and a scope change with high confidentiality, integrity, and availability impact. A separate CVSS 4.0 assessment from the same source rates it 9.4 (CRITICAL). The stored nature means the payload persists in shared content and fires passively for anyone who views it, so a single low-privileged contributor can reach other users of the workspace without further interaction on their part beyond opening the database.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; no active exploitation has been confirmed in the supplied source data.
What's Vulnerable
- Vendor: siyuan-note
- Product: SiYuan (
pkg:golang/github.com/siyuan-note/siyuan/kernel) - Affected: all versions before 3.7.4
- Not affected: 3.7.4 and later
The vulnerable code path is attribute-view select option rendering, reached through any database object that carries a select field.
Patch Status
Fixed in SiYuan v3.7.4. Upgrading to v3.7.4 or later is the remediation; the vendor lists all prior versions as affected and 3.7.4 as unaffected. No workaround is described in the source material. The issue was disclosed via VulnCheck and documented in a GitHub security advisory.
Sources
- NVD, CVE-2026-73050 (record published 2026-08-15, source
[email protected]) - GitHub Security Advisory GHSA-m7cc-jh9q-wxg8; https://github.com/siyuan-note/siyuan/security/advisories/GHSA-m7cc-jh9q-wxg8
- VulnCheck Advisory; https://www.vulncheck.com/advisories/siyuan-before-stored-xss-via-select-option-color