CVE: This vulnerability corresponds to CVE-2026-73050.
Summary
The attribute-view store accepts arbitrary strings for a select option's colour, a field the kernel documents as a palette index in the range 1 to 14. Eight frontend render sites interpolate that value directly into a style attribute with no escaping. A quotation mark in the stored value terminates the attribute, allowing an event-handler attribute to be injected.
The affected render sites cover ordinary display of select and multi-select values, so the payload executes on viewing a database rather than on any deliberate menu interaction.
Details
The field is documented as a small integer and never validated. kernel/av/value.go:785 declares:
No validation is applied on write. Confirmed against a running instance:
{"action":"updateAttrViewColOptions","id":"<keyID>","avID":"<avID>",
"data":[{"name":"PWN","color":"1);color:red\" onmouseover=\"alert(1)\" x=\"","desc":""}]}→ {"code":0}
renderAttributeView → {"name":"PWN","color":"1);color:red\" onmouseover=\"alert(1)\" x=\""}
on disk → "color":"1);color:red\"...
Eight unescaped sinks. All of the form:
style="background-color:var(--b3-font-background${item.color});color:var(--b3-font-color${item.color})"
app/src/protyle/render/av/attributeValue.ts:139app/src/protyle/render/av/cell.ts:1119app/src/protyle/render/av/col.ts:141app/src/protyle/render/av/filter.ts:696, :707, :709app/src/protyle/render/av/render.ts:277app/src/protyle/render/av/select.ts:43
The first quotation mark in the stored value closes the style attribute. What follows, onmouseover="alert(1)", is then parsed as a genuine event-handler attribute on the same element.
The neighbouring interpolations are escaped. Within the same template literals, ${escapeHtml(item.content)} and ${escapeAttr(item.name)} appear alongside the raw ${item.color}. The escaping helpers are present and in use; the colour field is simply not passed through them.
Reach. These sites render select and multi-select chips in table, gallery, kanban and relation views, and in the field-edit and filter menus. Opening a database that contains a select field is sufficient.
Consequence in the desktop application. app/electron/main.js sets nodeIntegration: true, contextIsolation: false and webSecurity: false on every window (lines 913, 1019-1022, 1933-1936, 2157, 2197, 2248), so script executing in a renderer reaches Node built-ins including require('child_process').
Scope of observation. The storage behaviour, the API response and the eight interpolation sites are confirmed as described. I have not observed handler execution in a running client, so the step from attribute injection to handler invocation is stated from the code rather than from a captured result.
Relationship to existing advisories. b3-font-background, updateAttrViewColOptions, item.color and --b3-font each appear in no published advisory for this project. GHSA-5rxg-* is the same class, an unescaped value reaching a style attribute, but concerns the title-img IAL attribute on the gallery and kanban cover image. That is a different field in a different store: IAL values are HTML-escaped on write, whereas attribute-view values are not, so the fix for that advisory cannot reach this field.
Proof of Concept
Set a select option's colour to a value containing a quotation mark:
POST /api/transactions
{"reqId":<numeric>, ... "action":"updateAttrViewColOptions",
"data":[{"name":"PWN","color":"1);color:red\" onmouseover=\"alert(1)\" x=\"","desc":""}]}
→ {"code":0}
Confirm it is stored and served unmodified:
POST /api/av/renderAttributeView
→ color returned verbatim, quotation marks intact
Then open any view displaying that option.
Impact
A stored value under attacker control breaks out of a style attribute and injects an event handler wherever a select or multi-select option is rendered. Because the affected sites include ordinary table, gallery, kanban and relation rendering, no deliberate interaction with menus is required.
In the desktop client the renderer has Node integration enabled, so execution at that point is not confined to the page.
The value is written through a normal option-configuration operation, so any path by which a database reaches a victim, including import, synchronisation, a shared workspace or a distributed package, carries the payload.
Suggested fix
Apply escapeAttr to item.color at all eight sites.
More durably, enforce the documented contract in the kernel: Color is specified as a value in the range 1 to 14, so constraining it to that palette on write removes the field as an injection source entirely and neutralises any value already stored.
Shirshakhtml Reporter
CVE: This vulnerability corresponds to CVE-2026-73050.
Summary
The attribute-view store accepts arbitrary strings for a select option's colour, a field the kernel documents as a palette index in the range 1 to 14. Eight frontend render sites interpolate that value directly into a
styleattribute with no escaping. A quotation mark in the stored value terminates the attribute, allowing an event-handler attribute to be injected.The affected render sites cover ordinary display of select and multi-select values, so the payload executes on viewing a database rather than on any deliberate menu interaction.
Details
The field is documented as a small integer and never validated.
kernel/av/value.go:785declares:No validation is applied on write. Confirmed against a running instance:
{"action":"updateAttrViewColOptions","id":"<keyID>","avID":"<avID>", "data":[{"name":"PWN","color":"1);color:red\" onmouseover=\"alert(1)\" x=\"","desc":""}]}Eight unescaped sinks. All of the form:
app/src/protyle/render/av/attributeValue.ts:139app/src/protyle/render/av/cell.ts:1119app/src/protyle/render/av/col.ts:141app/src/protyle/render/av/filter.ts:696,:707,:709app/src/protyle/render/av/render.ts:277app/src/protyle/render/av/select.ts:43The first quotation mark in the stored value closes the
styleattribute. What follows,onmouseover="alert(1)", is then parsed as a genuine event-handler attribute on the same element.The neighbouring interpolations are escaped. Within the same template literals,
${escapeHtml(item.content)}and${escapeAttr(item.name)}appear alongside the raw${item.color}. The escaping helpers are present and in use; the colour field is simply not passed through them.Reach. These sites render select and multi-select chips in table, gallery, kanban and relation views, and in the field-edit and filter menus. Opening a database that contains a select field is sufficient.
Consequence in the desktop application.
app/electron/main.jssetsnodeIntegration: true,contextIsolation: falseandwebSecurity: falseon every window (lines 913, 1019-1022, 1933-1936, 2157, 2197, 2248), so script executing in a renderer reaches Node built-ins includingrequire('child_process').Scope of observation. The storage behaviour, the API response and the eight interpolation sites are confirmed as described. I have not observed handler execution in a running client, so the step from attribute injection to handler invocation is stated from the code rather than from a captured result.
Relationship to existing advisories.
b3-font-background,updateAttrViewColOptions,item.colorand--b3-fonteach appear in no published advisory for this project. GHSA-5rxg-* is the same class, an unescaped value reaching astyleattribute, but concerns thetitle-imgIAL attribute on the gallery and kanban cover image. That is a different field in a different store: IAL values are HTML-escaped on write, whereas attribute-view values are not, so the fix for that advisory cannot reach this field.Proof of Concept
Set a select option's colour to a value containing a quotation mark:
Confirm it is stored and served unmodified:
Then open any view displaying that option.
Impact
A stored value under attacker control breaks out of a
styleattribute and injects an event handler wherever a select or multi-select option is rendered. Because the affected sites include ordinary table, gallery, kanban and relation rendering, no deliberate interaction with menus is required.In the desktop client the renderer has Node integration enabled, so execution at that point is not confined to the page.
The value is written through a normal option-configuration operation, so any path by which a database reaches a victim, including import, synchronisation, a shared workspace or a distributed package, carries the payload.
Suggested fix
Apply
escapeAttrtoitem.colorat all eight sites.More durably, enforce the documented contract in the kernel:
Coloris specified as a value in the range 1 to 14, so constraining it to that palette on write removes the field as an injection source entirely and neutralises any value already stored.