CVE-2026-73050 is a stored cross-site scripting vulnerability in SiYuan note-taking software before version 3.7.4. The issue arises because the application fails to properly validate or escape the color field used in attribute-view select options. Attackers can exploit this by injecting event-handler attributes through quotation marks in the color value, leading to arbitrary JavaScript execution when the malicious select field is rendered in the user interface. This vulnerability affects eight unescaped render sites within the software.

Successful exploitation allows an attacker with limited privileges to execute arbitrary JavaScript code in the context of the victim's browser when viewing databases containing the malicious select field. This can lead to session hijacking, data theft, or other malicious actions within the affected application environment. The CVSS 4.0 score of 9.4 reflects a critical severity with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before v3.7.4, upgrading to version 3.7.4 or later is recommended once an official fix is released. Until then, avoid using untrusted input in the color field of attribute-view select options and consider applying temporary input validation or sanitization controls if possible.