XSS Vulnerability in SiYuan Personal Knowledge Management System
CVE-2026-32940
What is CVE-2026-32940?
The SiYuan Personal Knowledge Management System, in versions 3.6.0 and earlier, contains a vulnerability in its handling of SVG content. Specifically, the SanitizeSVG function has an incomplete blocklist that fails to block 'data:text/xml' and 'data:application/xml' MIME types. This oversight allows an attacker to craft a malicious URL leading to the '/api/icon/getDynamicIcon' endpoint, where user-controlled input is directly incorporated into SVG markup. If a victim navigates to the crafted URL, they may interact with the SVG, leading to execution of injected JavaScript when they click on an embedded link. This issue mandates direct navigation or specific HTML embedding techniques for exploitation. The vulnerability was addressed in version 3.6.1.
Affected Version(s)
siyuan < 3.6.1