Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary JavaScript when viewing databases containing the malicious select field.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-73050 Stored XSS in SiYuan v3.7.4 Via Unescaped Color Field https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-73050
Post summary
CVE‑2026‑73050 is a stored XSS flaw in SiYuan 3.7.4 caused by an unescaped color field; the post provides technical details but offers no PoC, exploit code, active exploitation evidence, or patch information.