SiYuan Stored XSS via Select Option Color Field (CVE-2026-73050)

Executive Summary

CVE-2026-73050 is a stored cross-site scripting (XSS) vulnerability in SiYuan versions prior to v3.7.4. The vulnerability lies in the attribute-view select option color field: SiYuan renders this value at eight separate locations without sanitization. An attacker who can edit database select options can inject a color value containing quotation marks and event handler attributes, causing persistent JavaScript execution for any user who views the affected database.

CVSS Score: 9.0 (Critical)

Vulnerability Overview

Root Cause

SiYuan's attribute-view component renders select option color values in HTML attributes (typically style or class attributes used for color-coded badges). The color string is stored as-is and embedded at eight distinct render sites across the UI — option badges, filter dropdowns, sort menus, column settings, and view summaries — without HTML-encoding quotation marks or other special characters.

A malicious color value such as:

red" onmouseover="eval(atob('BASE64_PAYLOAD'))

...breaks out of the attribute context at every one of those eight render sites, multiplying the attack surface significantly.

Attack Scenario

1. Attacker with database-editor access creates or edits a select option
2. Sets the option color to a malicious string containing HTML break-out payload
3. Payload is stored persistently in the SiYuan database
4. Any user who views the database — in gallery, table, or filter view — triggers XSS
5. Eight render sites mean the payload fires from multiple distinct UI interactions
6. Attacker exfiltrates notes, session data, or performs actions as the victim

Eight Render Sites

The color field is rendered in:

1. Option badge in table cell
2. Option badge in gallery card
3. Filter panel option list
4. Sort/group panel option list
5. Column settings option editor
6. Select dropdown picker
7. View summary statistics
8. Attribute panel sidebar

Each is an independent XSS trigger point — one poisoned option poisons all eight locations simultaneously.

Affected Versions

Remediation

Patch

Update SiYuan to v3.7.4 or later. The fix sanitizes the color field value before storage and applies proper HTML entity encoding at all eight render sites, ensuring only valid CSS color values are accepted and rendered.

If Immediate Patching Is Not Possible

1. Restrict database-editor access to trusted users only.
2. Audit existing select options — inspect .sy files for color values containing ", ', or event handler keywords.
3. Reset any suspicious options to standard color values (hex codes, named colors).

Detection

Finding Malicious Color Values

Search SiYuan's data/ directory for suspicious option color strings:

# Search .sy files for color values with unusual characters
grep -r '"color"' /path/to/siyuan/data/ | grep -E '["'"'"'<>]'

Look for option colors that contain anything other than:

• CSS named colors (red, blue, green, etc.)
• Hex codes (#FF0000)
• RGB/HSL functions (rgb(255,0,0))

Key Takeaways

1. CVSS 9.0 Critical — Stored XSS firing at 8 render sites from a single poisoned option
2. Multiplied attack surface — one malicious option causes XSS across gallery, table, filter, sort, and settings views simultaneously
3. Patch to SiYuan v3.7.4 immediately for any multi-user or networked installation
4. Fourth in a cluster — CVE-2026-73042, -73044, -73046, and -73050 are all fixed in v3.7.4; treat as a mandatory group patch
5. Color fields are an overlooked injection vector — any user-supplied string embedded in HTML attributes requires sanitization

References

• NVD — CVE-2026-73050
• SiYuan GitHub

Related Advisories

• SiYuan Database Menu XSS — CVE-2026-73042
• SiYuan Style Attribute XSS — CVE-2026-73044
• SiYuan Auth Brute-Force — CVE-2026-73046