PT-2026-3304 · Siyuan · Siyuan

Jaroslaw-Wawiorko · Published 2026-01-16 · Updated 2026-02-06 · CVE-2026-23645

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.5.4-dev2

Description SiYuan Note does not properly sanitize uploaded SVG files. This allows a user to upload a malicious SVG file, such as one obtained from an untrusted source, which can then execute arbitrary JavaScript code within the user's authenticated session when viewed. The application permits authenticated users to upload files, including .svg images, without removing potentially harmful JavaScript code embedded within them. The vulnerability is triggered when a user exports the malicious SVG file, causing the embedded JavaScript to execute in their browser.

Recommendations Update SiYuan to version 3.5.4-dev2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-23645

GHSA-PCJQ-J3MQ-JV5J

GO-2026-4324

SUSE-SU-2026:0403-1

Affected Products

Siyuan

References · 88

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23645.json · Exploit
• https://github.com/siyuan-note/siyuan/commit/11115da3d0de950593ee4ce375cf7f9018484388 · Patch
• https://github.com/siyuan-note/siyuan/issues/16844 · Patch
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pcjq-j3mq-jv5j · Patch
• https://osv.dev/vulnerability/CVE-2026-23645 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4324 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23645 · Security Note
• https://osv.dev/vulnerability/GHSA-pcjq-j3mq-jv5j · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://github.com/siyuan-note/siyuan · Note
• https://suse.com/security/cve/CVE-2026-24514 · Note
• https://suse.com/security/cve/CVE-2026-24117 · Note
• https://suse.com/security/cve/CVE-2026-25145 · Note
• https://suse.com/security/cve/CVE-2026-23992 · Note
• https://suse.com/security/cve/CVE-2026-20897 · Note