Stored and Reflected Cross-Site Scripting in SiYuan Product

CVE-2026-66394

What is CVE-2026-66394?

SiYuan versions prior to v3.7.3 are affected by stored and reflected cross-site scripting vulnerabilities stemming from improper SVG sanitization. This vulnerability allows authenticated attackers to inject executable scripts, effectively bypassing the HTML parser-cleaner. By embedding script tags within SVG elements such as desc, style, or noscript, attackers can manipulate the content, which the browser interprets as executable code in the application context when delivered as image/svg+xml. This could lead to unauthorized actions on behalf of the user or exposure of sensitive information.

References