THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-73050 (CRITICAL 9.0) — SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, exe

[NVD] CVE-2026-73050 (CRITICAL 9.0) — SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, exe

mednvdPublished 2026-08-15

CVE-2026-73050 CVSS: 9.0 CRITICAL Published: 2026-08-15T22:16:54.870

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary JavaScript when viewing databases

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-73050cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-73050