Skip to content
Threat Feed
Subscribe

Product

SiYuan (< 3.7.3)

1 brief RSS
high advisory

CVE-2026-66394: SiYuan XSS Vulnerabilities in SVG Sanitization

Authenticated attackers can exploit stored and reflected cross-site scripting (XSS) vulnerabilities, identified as CVE-2026-66394, in SiYuan versions prior to v3.7.3 by bypassing the application's SVG sanitization to execute arbitrary scripts within the application's origin, potentially leading to session hijacking and data exfiltration.

SiYuan xss web-application vulnerability svg-sanitization
2t 1c