Executive Summary

This vulnerability exists in SiYuan, a personal knowledge management system, in versions prior to 3.5.10. The SVG sanitizer (SanitizeSVG) is designed to block dangerous SVG elements like <script>, <iframe>, and <foreignobject>, as well as remove event handlers and javascript: in href attributes. However, it does not block SVG animation elements such as <animate> and <set>, which can dynamically change attributes to dangerous values at runtime. This allows an attacker to inject executable JavaScript through the unauthenticated /api/icon/getDynamicIcon endpoint (type=8), resulting in a reflected Cross-Site Scripting (XSS) attack. This vulnerability bypasses a previous fix (CVE-2026-29183) and is resolved in version 3.5.10.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to inject and execute malicious JavaScript code in the context of the affected application without authentication. This reflected XSS can lead to unauthorized actions such as stealing user credentials, session hijacking, defacement, or delivering malware to users interacting with the vulnerable endpoint.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade SiYuan to version 3.5.10 or later, as this version includes the fix that blocks SVG animation elements which can be used to inject executable JavaScript.

Useful 0 Not Useful 0