SiYuan notes app has XSS flaws

Published September 3, 2026 GHSA-99rq-75j6-5j9f

SiYuan, a note-taking app, can be tricked into running an attacker's script inside the app when it displays an SVG image file. This happens because the app's own cleanup tool for SVG files fails to strip out a hidden script.

Severity
HighCVSS 8.7
Fix
Fixed in 0.0.0-20260714095344-f08dee71ba8eFix recorded on Sep 3, 2026
Affected versions
before 0.0.0-20260714095344-f08dee71ba8e
Weakness
CWE-79
Affects
SiYuan

How it works

SiYuan strips dangerous code from uploaded SVG images using a cleaning tool that reads the file as regular web page text, but the app later shows that same file to the browser as an image, and browsers read images with different rules, so a script hidden inside certain image tags survives the cleaning step and still runs.

What to do

Check the SiYuan kernel version or build date in the app. Any build of github.com/siyuan-note/siyuan/kernel earlier than commit 0.0.0-20260714095344-f08dee71ba8e is affected.

Update SiYuan to a kernel build from 0.0.0-20260714095344-f08dee71ba8e or later through the app's normal updater or the official GitHub releases page, and avoid opening SVG files or icon links from people you do not trust until you update.

Technical details

util. SanitizeSVG in kernel/util/misc.go parses attacker-controlled SVG/HTML with an HTML parser to remove tags like script and event handlers, then serves the sanitized file as image/svg+xml. HTML parsing rules for foreignObject, desc, and title elements differ from XML/SVG parsing rules, letting a crafted structure hide a script element from the HTML-mode walker while the browser's XML-mode SVG parser still executes it.

The bug is reachable reflected via GET /api/icon/getDynamicIcon and stored via a planted.svg asset under /assets/. SiYuan ships no Content Security Policy to block the resulting script execution in the app origin. One fix in the shared cleaner closes both paths.

References

View Original Source