CVE-2026-32940 - Vulnerability Analysis

Overview

SiYuan <= 3.6.0 contains a stored XSS caused by incomplete SanitizeSVG blocklist missing data:text/xml and data:application/xml in href attributes in /api/icon/getDynamicIcon endpoint, letting unauthenticated attackers execute JavaScript via crafted SVG links, exploit requires victim to navigate or embed the crafted SVG.

Severity & Score

Impact

Unauthenticated attackers can execute JavaScript in victim's browser via crafted SVG links, leading to potential session hijacking or other client-side attacks.

Mitigation

Update to version 3.6.1 or later.

References

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4mx9-3c2h-hwhg
• https://github.com/advisories/GHSA-6865-qjcf-286f
• https://github.com/siyuan-note/siyuan/commit/d01d561875d4f744e9f6232f1d4831e3642b8696
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner