CVE-2026-66394
Received Received - Intake

SiYuan SVG Sanitization Flaws Enable XSS Attacks

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: VulnCheck

Description
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML parser treats as raw text but browsers interpret as executable SVG content when served as image/svg+xml, enabling script execution in the application origin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-66394
EUVD
EUVD-2026-49327

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored and reflected cross-site scripting (XSS) flaw in SiYuan before version 3.7.3. It occurs due to a sanitizer bypass in SVG handling where attackers can embed script tags within SVG elements like desc, style, or noscript. The HTML parser treats these as raw text, but browsers interpret them as executable SVG content when served with the image/svg+xml MIME type, enabling script execution within the application's origin.

Detection Guidance

To detect this vulnerability, inspect SiYuan versions prior to 3.7.3 for SVG files containing malicious script tags within desc, title, or style elements. Check the assets directory for unauthorized SVG files and monitor network traffic for requests to the /api/icon/getDynamicIcon endpoint with suspicious payloads.

Impact Analysis

This vulnerability allows authenticated attackers to execute arbitrary JavaScript in the context of another user's browser session. This could lead to full workspace takeover in the desktop app, unauthorized data access, or manipulation of user sessions. Attackers can exploit it via crafted links or by planting malicious SVG files in the assets directory.

Compliance Impact

This vulnerability can lead to unauthorized data access or manipulation, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using vulnerable SiYuan versions could face compliance breaches, legal penalties, or reputational damage due to potential data exposure or integrity issues.

Mitigation Strategies

Immediately upgrade SiYuan to version 3.7.3 or later. Disable SVG script execution by ensuring AllowSVGScript=false is enforced. Implement a strict Content Security Policy (CSP) and serve user SVG files with Content-Disposition: attachment to prevent execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66394. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart