Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function introduced in version 3.6.0 to fix XSS in the unauthenticated /api/icon/getDynamicIcon endpoint can be bypassed by using namespace-prefixed element names such as <x:script xmlns:x="http://www.w3.org/2000/svg">. The Go HTML5 parser records the element's tag as "x:script" rather than "script", so the tag check passes it through. The SVG is served with Content-Type: image/svg+xml and no Content Security Policy; when a browser opens the response directly, its XML parser resolves the prefix to the SVG namespace and executes the embedded script. This issue has been patched in version 3.6.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-34605 SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function introduced in version 3.6.0 to fix XSS in the u… https://www.cve.org/CVERecord?id=CVE-2026-34605
Post summary
CVE-2026-34605 is an XSS vulnerability in SiYuan that was addressed by the SanitizeSVG function introduced in version 3.6.0, providing a patch to mitigate the issue.
🚨 CVE-2026-34605 - medium 🚨 SiYuan Note - Cross-Site Scripting > SiYuan Note through version 3.6.1 is vulnerable to unauthenticated reflected Cross-Si... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-34605 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet announces CVE-2026-34605, a medium‑severity reflected XSS vulnerability affecting SiYuan Note versions up to 3.6.1, and provides a link to the CVE library for more details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | b3log | siyuan | - | - | - |