PT-2026-24462 · Siyuan · Siyuan

0Xkakash1 · Published 2026-03-10 · Updated 2026-03-25 · CVE-2026-31807

Positive Technologies (AI Summary)

CVSS v4.0

6.4

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.5.10

Description SiYuan is a personal knowledge management system. The SVG sanitizer (SanitizeSVG) in versions prior to 3.5.10 does not block SVG animation elements (, ), allowing attackers to dynamically set attributes to dangerous values at runtime, bypassing static sanitization. This enables the injection of executable JavaScript into the unauthenticated /api/icon/getDynamicIcon endpoint (type=8), resulting in a reflected Cross-Site Scripting (XSS) condition. This is a bypass of a previous fix. The vulnerable parameter is type.

Recommendations Update to version 3.5.10 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-31807

GHSA-5HC8-QMG8-PW27

GO-2026-4667

SUSE-SU-2026:1042-1

Affected Products

Siyuan

References · 134

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31807.json · Exploit
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5hc8-qmg8-pw27 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31807 · Security Note
• https://osv.dev/vulnerability/GO-2026-4667 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5hc8-qmg8-pw27 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31807 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://github.com/siyuan-note/siyuan · Note
• https://github.com/siyuan-note/siyuan/releases/tag/v3.5.10 · Note
• https://suse.com/security/cve/CVE-2026-28789 · Note
• https://suse.com/security/cve/CVE-2026-29781 · Note
• https://suse.com/security/cve/CVE-2026-27808 · Note
• https://suse.com/security/cve/CVE-2026-31886 · Note
• https://suse.com/security/cve/CVE-2026-23999 · Note
• https://suse.com/security/cve/CVE-2026-32246 · Note