CyberRota Analysis
AI-GeneratedSiYuan versions prior to 3.7.4 are vulnerable due to inadequate validation of the color field in attribute-view select options, enabling stored cross-site scripting (XSS) attacks through unescaped render sites. This flaw allows attackers to inject malicious JavaScript, which executes when users interact with affected databases. Organizations using SiYuan should prioritize patching to mitigate the risk of XSS exploitation and potential data compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary JavaScript when viewing databases containing the malicious select field.