CVE-2026-66394
High
Description
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML parser treats as raw text but browsers interpret as executable SVG content when served as image/svg+xml, enabling script execution in the application origin.
SeverityHigh
CVSS8.7
Exploit probability—
ProductGithub.com/siyuan-note/siyuan/kernel
PublishedJul 27, 2026
First seenJul 27, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- github.com/siyuan-note/siyuan/kernel0.0.0-20260714095344-f08dee71ba8e or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/siyuan-note/siyuan/kernelGo | v < 0.0.0-20260714095344-f08dee71ba8e | 0.0.0-20260714095344-f08dee71ba8e |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.