CVE-2026-73050

creationtimestamp| type| source ---|---|--- 2026-08-15 23:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mt5s6sffiv2p 2026-08-16 00:00:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mt5uzlhyl72m...

CVE-2026-73050 SiYuan before v3.7.4 Stored XSS via select option color

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary...