CVE-2026-31807Disclosure(b3log / siyuan)

LOWCVSS 6.1 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch b3log siyuan systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) blocks dangerous elements (<script>, <iframe>, <foreignobject>) and removes on* event handlers and javascript: in href attributes. However, it does NOT block SVG animation elements (<animate>, <set>) which can dynamically set attributes to dangerous values at runtime, bypassing the static sanitization. This allows an attacker to inject executable JavaScript into the unauthenticated /api/icon/getDynamicIcon endpoint (type=8), creating a reflected XSS. This is a bypass of the fix for CVE-2026-29183 (fixed in v3.5.9). This vulnerability is fixed in v3.5.10.

b3log CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5hc8-qmg8-pw27

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

siyuan

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
4 mentions across 4 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 3d ago at 1 mentions (2026-03-10); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

b3log

Products

siyuan

Deep dive

Activity timeline4 mentions / 4d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-10	1	Disclosure1
2026-03-12	1	Disclosure1
2026-04-02	1	Disclosure1
2026-09-20	1	General1

Full discourse4 posts

pdnuclei-bot@pdnuclei_bot191d
Disclosure
🚨 CVE-2026-31807 - medium 🚨 SiYuan <= v3.5.9 - SVG Animate Element XSS > SiYuan <= v3.5.9 contains a reflected XSS caused by insufficient SVG sanitization all... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-31807 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet announces CVE-2026-31807, a reflected XSS due to inadequate SVG sanitization in SiYuan versions up to 3.5.9, and links to a Project Discovery library entry.
00002225
905 followersView on X
Sarthak M.@shaivarth20d
General
fixed a matcher logic issue in the template for CVE-2026-31807 https://github.com/projectdiscovery/nuclei-templates/pull/17240
Post summary
The tweet reports a matcher logic issue fix for CVE-2026-31807 and links to a Nuclei template PR, providing technical details but no explicit patch, exploit, or evidence of active exploitation.
0000040
15 followersView on X
DailyCVE@dailycve212d
Disclosure
🟠 SiYuan, Cross-site Scripting, #CVE-2026-31807 (Medium) https://dailycve.com/siyuan-cross-site-scripting-cve-2026-31807-medium/
Post summary
The post announces a medium‑severity XSS vulnerability (CVE‑2026‑31807) in SiYuan and links to a dailyCVE article, but offers no PoC, exploit, or patch details.
0000026
167 followersView on X
CVE@CVEnew213d
Disclosure
CVE-2026-31807 SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) blocks dangerous elements (<script>, <iframe>, <foreignobject>… https://www.cve.org/CVERecord?id=CVE-2026-31807
Post summary
CVE-2026-31807 highlights a vulnerability in SiYuan’s SVG sanitizer that fails to block certain dangerous elements before version 3.5.10, with a patch implied in newer releases but no PoC, exploit, or active exploitation reported.
00000266
56.7K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	b3log	siyuan	-	-	-

Explore more

Back to dashboard b3log CVEs siyuan vulnerabilities

What researchers are saying

CVE-2026-31807

pdnuclei-bot@pdnuclei_botDisclosure

The tweet announces CVE-2026-31807, a reflected XSS due to inadequate SVG sanitization in SiYuan versions up to 3.5.9, and links to a Project Discovery library entry.

Sarthak M.@shaivarthGeneral

The tweet reports a matcher logic issue fix for CVE-2026-31807 and links to a Nuclei template PR, providing technical details but no explicit patch, exploit, or evidence of active exploitation.

DailyCVE@dailycveDisclosure

The post announces a medium‑severity XSS vulnerability (CVE‑2026‑31807) in SiYuan and links to a dailyCVE article, but offers no PoC, exploit, or patch details.

CVE@CVEnewDisclosure

CVE-2026-31807 highlights a vulnerability in SiYuan’s SVG sanitizer that fails to block certain dangerous elements before version 3.5.10, with a patch implied in newer releases but no PoC, exploit, or active exploitation reported.