CVE-2026-32940 Details
Description
SiYuan is a personal knowledge management system. In versions 3.6.0 and below, SanitizeSVG has an incomplete blocklist — it blocks data:text/html and data:image/svg+xml in href attributes but misses data:text/xml and data:application/xml, both of which can render SVG with JavaScript execution. The unauthenticated /api/icon/getDynamicIcon endpoint serves user-controlled input (via the content parameter) directly into SVG markup using fmt.Sprintf with no escaping, served as Content-Type: image/svg+xml. This creates a click-through XSS: a victim navigates to a crafted URL, sees an SVG with an injected link, and clicking it triggers JavaScript via the bypassed MIME types. The attack requires direct navigation to the endpoint or <object>/<embed> embedding, since <img> tag rendering in the frontend doesn't allow interactive links. This issue has been fixed in version 3.6.1.
A reflected cross-site scripting vulnerability has been identified in SiYuan, a personal knowledge management system, specifically in versions through 3.6.0. The issue arises from the SanitizeSVG function, which fails to adequately block certain data types that can execute JavaScript when rendered as SVG. The vulnerability is present in the unauthenticated API endpoint /api/icon/getDynamicIcon, which serves user-controlled content as image/svg+xml without proper escaping. This flaw allows the injection of executable SVG elements, such as links with JavaScript event handlers, creating a click-through XSS scenario. Exploitation requires direct navigation to the crafted URL or embedding the SVG in an object or embed tag, as image tags do not support interactive links.
Users can upgrade to SiYuan version 3.6.1, which addresses this vulnerability by improving the SanitizeSVG function to block data:text/xml and data:application/xml URIs.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/advisories/GHSA-6865-qjcf-286f | [email protected] | ExploitThird Party Advisory |
| https://github.com/siyuan-note/siyuan/commit/d01d561875d4f744e9f6232f1d4831e3642b8696 | [email protected] | Patch |
| https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1 | [email protected] | Release Notes |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4mx9-3c2h-hwhg | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-184 | Incomplete List of Disallowed Inputs | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| b3log siyuan | < 3.6.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |