CVE-2026-34605
Description
SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function introduced in version 3.6.0 to fix XSS in the unauthenticated /api/icon/getDynamicIcon endpoint can be bypassed by using namespace-prefixed element names such as <x:script xmlns:x="http://www.w3.org/2000/svg">. The Go HTML5 parser records the element's tag as "x:script" rather than "script", so the tag check passes it through. The SVG is served with Content-Type: image/svg+xml and no Content Security Policy; when a browser opens the response directly, its XML parser resolves the prefix to the SVG namespace and executes the embedded script. This issue has been patched in version 3.6.2.
How to fix
- b3log siyuan3.6.2 or later
- github.com/siyuan-note/siyuan/kernel0.0.0-20260330031106-f09953afc57a or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| b3log siyuan | 3.6.0 ≤ v < 3.6.2 | 3.6.2 |
| github.com/siyuan-note/siyuan/kernelGo | v < 0.0.0-20260330031106-f09953afc57a | 0.0.0-20260330031106-f09953afc57a |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.