CVE-2026-31809

Medium

Description

SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) checks href attributes for the javascript: prefix using strings.HasPrefix(). However, inserting ASCII tab (	), newline (
), or carriage return () characters inside the javascript: string bypasses this prefix check. Browsers strip these characters per the WHATWG URL specification before parsing the URL scheme, so the JavaScript still executes. This allows an attacker to inject executable JavaScript into the unauthenticated /api/icon/getDynamicIcon endpoint, creating a reflected XSS. This is a second bypass of the fix for CVE-2026-29183 (fixed in v3.5.9). This vulnerability is fixed in 3.5.10.

SeverityMedium

CVSS6.1

Exploit probability—

ProductB3log Siyuan

PublishedMar 10, 2026

First seenMar 10, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

b3log siyuan3.5.10 or later
github.com/siyuan-note/siyuan/kernel0.0.0-20260310025236-297bd526708f or later

Affected products

Product	Affected versions	Fixed in
b3log siyuan	v < 3.5.10	3.5.10
github.com/siyuan-note/siyuan/kernelGo	v < 0.0.0-20260310025236-297bd526708f	0.0.0-20260310025236-297bd526708f

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.