PT-2026-26178 · Siyuan · Siyuan
Vnykmshr
·
Published
2026-03-04
·
Updated
2026-03-27
·
CVE-2026-32940
CVSS v3.1
9.3
Critical
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
SiYuan versions 3.6.0 and earlier
Description
SiYuan, a personal knowledge management system, has an incomplete blocklist in its SanitizeSVG function. The function blocks 'data:text/html' and 'data:image/svg+xml' in 'href' attributes but fails to block 'data:text/xml' and 'data:application/xml', both of which can render SVG with JavaScript execution. The unauthenticated API endpoint ''/api/icon/getDynamicIcon'' serves user-controlled input via the
content parameter directly into SVG markup using fmt.Sprintf without escaping, served as Content-Type: image/svg+xml. This creates a click-through XSS issue where a victim navigating to a crafted URL sees an SVG with an injected link, and clicking it triggers JavaScript through the bypassed MIME types. The attack requires direct navigation to the endpoint or embedding via the or tags. The vulnerable code resides in kernel/util/misc.go lines 289-293, where the blocklist does not include 'text/xml' and 'application/xml'.
Recommendations
Update to version 3.6.1 or later. As an alternative, modify the data: URI check to an allowlist, permitting only safe image types in 'href', such as 'data:image/png', 'data:image/jpeg', 'data:image/gif', and 'data:image/webp'.
Exploit
Fix
Incomplete List of Disallowed Inputs
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Siyuan