External risk intelligence

SiYuan Stored Cross-Site Scripting via Select Option Color Field

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-73050

SiYuan is a personal knowledge management tool typically deployed as a local desktop or private self-hosted application. It is not designed as a public-facing internet service, and the vulnerability requires user interaction within the application's private interface, making external public network exploitation highly unlikely.

Cross-site Scripting

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw exists in SiYuan software that could allow an attacker to inject malicious code into databases. This vulnerability allows for cross-site scripting, meaning that if a user views a database containing the malicious code, arbitrary JavaScript could be executed, potentially leading to unauthorized actions or information exposure. The main concern is confirming relevance and exposure, as this software is typically used locally or on private networks.

Malicious code injection via color settings.
Affects private data, user interaction needed.
Confirm relevance for local or self-hosted use.

Attack Path

How an attacker could exploit the issue

An attacker can inject malicious code into a SiYuan database by exploiting a flaw in how the application handles color values for select options. This occurs when the attacker can get a user to view a database that contains a specially crafted select field. The vulnerability lies in the application's failure to properly validate or escape these color values, allowing for the execution of arbitrary JavaScript code within the user's browser.

Attacker needs limited user privileges.
Malicious color value in select option.
Stored cross-site scripting and arbitrary JavaScript execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, the color field in attribute-view select options could allow attackers to inject event-handler attributes. This could lead to arbitrary JavaScript execution when viewing databases containing a malicious select field.

System data could be affected.
Stored cross-site scripting may occur.
Arbitrary JavaScript execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that SiYuan is primarily a local or self-hosted application, the first step is to identify all instances of the affected technology, determine their reachability and criticality, and then locate the accountable owner for remediation planning. This involves collaboration between system owners, potentially application administrators, and security teams to assess risk and schedule necessary updates.

Confirm affected asset ownership.
Verify user interaction exposure.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SiYuan software?

SiYuan is a privacy-focused personal knowledge management tool. It functions as a local desktop application or a self-hosted platform where users create databases and manage notes. Because it is designed to store personal or private organizational data, it typically runs in restricted or private environments rather than as a public-facing web service.

How does CVE-2026-73050 work?

This vulnerability is classified as Stored Cross-Site Scripting (CWE-79). The software fails to properly filter or escape color settings in attribute-view select options. By inserting specific quotation marks into these color values, an attacker can inject malicious JavaScript. This code is then saved in the database and executed whenever a user views that specific entry.

Can any database input trigger this bug?

No. The issue is specific to the color field within attribute-view select options. It cannot be triggered by standard note text or other fields that do not process color attributes in this way. Furthermore, the attack requires the malicious code to be successfully saved in a database, which the target user must then open and view.

Is my SiYuan instance at risk?

Halo Surface Signal indicates that external public exploitation is very unlikely because SiYuan is typically deployed as a local or private, self-hosted application. Because this bug requires user interaction and malicious input within your private interface, the primary risk involves users who share or import databases from untrusted sources.

What should I do if I use SiYuan?

First, verify which version of SiYuan you are running to see if it is older than v3.7.4. If you are on an affected version, prioritize updating the software to the latest release provided by the vendor. In the meantime, exercise caution when importing databases or select options provided by unknown or untrusted third parties.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.