SiYuan prior to version 3.7.4 fails to validate or escape the color field in attribute‑view select options, allowing attackers to store malicious code. By inserting quotation marks and event‑handler attributes into the color value, attackers can inject JavaScript that executes when a user views a database containing the compromised select field. This stored cross‑site scripting flaw permits arbitrary JavaScript execution within the victim’s browser context, potentially leading to session hijacking, data theft, or defacement.

The vulnerability affects Siyuan Note’s Siyuan application. All releases before v3.7.4 are vulnerable; any installation using an earlier version is at risk.

The flaw has a CVSS score of 9.4, indicating high severity. EPSS is not available and the issue is not listed in KEV. Exploitation requires an attacker to supply a malicious color value, which is stored in the database. Any user who subsequently views that database will trigger the injected JavaScript. The attack vector is stored XSS, necessitating write access to the select option color field and read access to view the database containing the payload.