SiYuan Column Width API Stored XSS (CVE-2026-73044)

**CVE-2026-73044 — Stored XSS in SiYuan (< 3.7.4):** A critical (CVSS 9.0) stored cross-site scripting vulnerability in SiYuan's setAttrViewColWidth API lets an authenticated attacker store a malicious width string that breaks out of a style attribute and injects event handlers, enabling arbitrary JavaScript execution in any user's browser who views the affected table; remediation is to upgrade to SiYuan v3.7.4 and apply access and data-audit mitigations.