CVE-2026-73050— SiYuan before v3.7.4 Stored XSS via select option color
Possible ATT&CK Techniques 1AI
T1189 · Drive-by CompromiseGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-73050
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SiYuan before v3.7.4 Stored XSS via select option color
Source: CVE Program / CVE List V5
Vulnerability Description
SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary JavaScript when viewing databases containing the malicious select field.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| siyuan-note | siyuan | 0 ~ 3.7.4 | - |
II. Public POCs for CVE-2026-73050
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73050
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-73050 (2)
Same Patch Batch · siyuan-note · 2026-08-15 · 11 CVEs total
| CVE-2026-73046 | 9.8 CRITICAL | SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth |
| CVE-2026-73043 | 9.0 CRITICAL | SiYuan before v3.7.4 Remote Code Execution via Template Calculation |
| CVE-2026-73042 | 9.0 CRITICAL | SiYuan before v3.7.4 Remote Code Execution via Menu Metadata |
| CVE-2026-73041 | 9.0 CRITICAL | SiYuan before v3.7.4 Remote Code Execution via PDF Annotations |
| CVE-2026-73044 | 9.0 CRITICAL | SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width |
| CVE-2026-73053 | 9.0 CRITICAL | SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji |
| CVE-2026-73052 | 9.0 CRITICAL | SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names |
| CVE-2026-73045 | 7.5 HIGH | SiYuan before 3.7.4 Brute-Force via authFilePublishAccess |
| CVE-2026-73054 | 7.5 HIGH | SiYuan before v3.7.4 Authentication Bypass via WebSocket |
| CVE-2026-73047 | 6.2 MEDIUM | siyuan before v3.7.4 Server-Side Template Injection via attribute-view |
IV. Related Vulnerabilities
Same product: siyuan
- CVE-2026-73054
SiYuan before v3.7.4 Authentication Bypass via WebSocket - CVE-2026-73053
SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji - CVE-2026-73052
SiYuan before v3.7.4 Stored XSS via Attribute-View Field Nam - CVE-2026-73047
siyuan before v3.7.4 Server-Side Template Injection via attr - CVE-2026-73046
SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Au
Same vendor: siyuan-note
- CVE-2026-73054
SiYuan before v3.7.4 Authentication Bypass via WebSocket - CVE-2026-73052
SiYuan before v3.7.4 Stored XSS via Attribute-View Field Nam - CVE-2026-73053
SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji - CVE-2026-73047
siyuan before v3.7.4 Server-Side Template Injection via attr - CVE-2026-73046
SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Au
Same weakness: CWE-79
- CVE-2026-2487
Admin Custom Login <= 3.6.4 - Authenticated (Administrator+) - CVE-2026-19922
code-projects Online Shopping System checkout.php cross site - CVE-2026-19916
code-projects Online Food Order System edit_food_items.php c - CVE-2026-73053
SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji - CVE-2026-73052
SiYuan before v3.7.4 Stored XSS via Attribute-View Field Nam
V. Comments for CVE-2026-73050
No comments yet