A critical stored cross-site scripting flaw in SiYuan allows authenticated users to execute arbitrary JavaScript by injecting malicious payloads into select option color fields.

The application fails to validate or escape the color field within attribute-view select options. This allows an attacker to inject event-handler attributes by including quotation marks in the input, which then execute when other users view the affected database records.

This vulnerability allows for the execution of arbitrary JavaScript in the context of other users' sessions, which can lead to session hijacking, data theft, or unauthorized actions performed on behalf of the victim. With a CVSS score of 9.0, this poses a high risk to the security of user data and the overall integrity of the collaborative environment.

Immediate Action: Upgrade to SiYuan version 3.7.4 or later immediately.

Proactive Monitoring: Review application logs for suspicious entries in attribute-view select options or unusual client-side script execution.

Compensating Controls: Limit the ability of users to define custom colors or metadata in attribute-view fields until the patch is applied.

Public Exploit Available: Unknown

Given the critical severity of this cross-site scripting vulnerability, administrators should ensure all instances are updated to version 3.7.4 as soon as possible. Prompt patching is essential to prevent unauthorized code execution within the user base.