CVE-2026-73050

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description Stored cross-site scripting is possible due to a failure to validate or escape the color field in attribute-view select options across eight unescaped render sites. An attacker can inject event-handler attributes by including quotation marks in the color value, which leads to the execution of arbitrary JavaScript when a user views databases containing the malicious select field.

Recommendations Update SiYuan to version 3.7.4 or later.