Description

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary JavaScript when viewing databases containing the malicious select field.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-08-15T22:16:54.870Z",
  "pubdate": "2026-08-15T22:16:54.870Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists in SiYuan versions prior to v3.7.4.\nThe vulnerability resides in the attribute-view select options where the color field fails to undergo proper input validation or output escaping.\nAuthenticated attackers capable of modifying or injecting malicious data into attribute-view select options can compromise user sessions and execute arbitrary JavaScript code within the context of the victim's browser.\nThe flaw manifests across eight distinct unescaped render sites within the application.\nSuccessful exploitation requires an attacker to inject specially crafted payloads containing quotation marks and event-handler attributes into the color field.\nWhen a user views affected databases containing the malicious select field, the injected script executes automatically, posing significant risks to data confidentiality and integrity.",
  "technicalDetails": "The root cause of the vulnerability is the absence of input sanitization and output escaping mechanisms for the color field associated with attribute-view select options in SiYuan.\nThe vulnerable components comprise eight unescaped render sites responsible for displaying the color configurations of select options in databases.\nAttackers exploit this flaw by supplying a malicious payload containing quotation marks into the color value field, thereby breaking out of the intended HTML attribute context.\nBy injecting malicious event-handler attributes (such as onload, onerror, or onmouseover) alongside executable JavaScript expressions, the attacker achieves stored cross-site scripting.\nThe attack flow proceeds as follows: 1) The attacker crafts an attribute-view select option payload containing malicious JavaScript within the color field. 2) The payload is stored persistently within the database backend. 3) A victim navigates to or views the database containing the malicious select field. 4) The application renders the color field across the eight vulnerable render sites without sanitization or escaping. 5) The browser parses the injected quotation marks, interprets the subsequent strings as HTML attributes and event handlers, and executes the arbitrary JavaScript.\nThe vulnerability affects SiYuan versions prior to v3.7.4.\nExploitation requires the ability to inject or modify attribute-view select option data, and hinges on user interaction where a victim views the affected database records.\nThe post-exploitation impact includes session hijacking, unauthorized access to sensitive notes and local data, and potential execution of further malicious actions within the desktop or web application context."
}