CVE-2026-34605 Details
Description
SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function introduced in version 3.6.0 to fix XSS in the unauthenticated /api/icon/getDynamicIcon endpoint can be bypassed by using namespace-prefixed element names such as <x:script xmlns:x="http://www.w3.org/2000/svg">. The Go HTML5 parser records the element's tag as "x:script" rather than "script", so the tag check passes it through. The SVG is served with Content-Type: image/svg+xml and no Content Security Policy; when a browser opens the response directly, its XML parser resolves the prefix to the SVG namespace and executes the embedded script. This issue has been patched in version 3.6.2.
A reflected cross-site scripting vulnerability has been identified in SiYuan, a personal knowledge management system, specifically in versions 3.6.0 prior to 3.6.2. The issue arises in the 'SanitizeSVG' function, which was introduced in version 3.6.0 to address cross-site scripting in the unauthenticated '/api/icon/getDynamicIcon' endpoint. The vulnerability can be exploited by using namespace-prefixed element names, such as '<x:script xmlns:x="http://www.w3.org/2000/svg">'. The Go HTML5 parser interprets the element's tag as 'x:script' instead of 'script', allowing the tag to bypass validation. As a result, SVG files are served with a 'Content-Type' of 'image/svg+xml' and without a Content Security Policy. When a browser directly opens the response, the XML parser executes the embedded script after resolving the prefix to the SVG namespace.
Users can upgrade to SiYuan version 3.6.2, which addresses this vulnerability by properly sanitizing namespace-prefixed element names.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/issues/17246 | [email protected] | Issue Tracking |
| https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2 | [email protected] | Release Notes |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-73g7-86qr-jrg3 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| b3log siyuan | >= 3.6.0, < 3.6.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 3, 2026 | Initial Analysis | [email protected] |
| Mar 31, 2026 | New CVE Received | [email protected] |