SiYuan (< 3.7.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/siyuan--3.7.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 27 Jul 2026 16:22:38 +0000CVE-2026-66394: SiYuan XSS Vulnerabilities in SVG Sanitizationhttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-66394-siyuan-xss/Mon, 27 Jul 2026 16:22:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-66394-siyuan-xss/Authenticated attackers can exploit stored and reflected cross-site scripting (XSS) vulnerabilities, identified as CVE-2026-66394, in SiYuan versions prior to v3.7.3 by bypassing the application's SVG sanitization to execute arbitrary scripts within the application's origin, potentially leading to session hijacking and data exfiltration.SiYuan, an open-source personal knowledge management system, is affected by stored and reflected cross-site scripting (XSS) vulnerabilities, tracked as CVE-2026-66394, present in versions before 3.7.3. These vulnerabilities stem from an insufficient SVG sanitization process that allows authenticated attackers to bypass the application's HTML parser-based cleaner. Specifically, attackers can embed malicious script tags within seemingly innocuous SVG elements such as <desc>, <style>, or <noscript>. While the HTML parser might treat these as raw text, browsers interpret them as executable content when the SVG is served as image/svg+xml. This flaw enables the execution of arbitrary JavaScript within the application's origin, posing a significant risk for session hijacking, data exfiltration, or other client-side attacks against legitimate users.

Attack Chain

  1. An authenticated attacker logs into the vulnerable SiYuan application.
  2. The attacker crafts a malicious SVG image file containing JavaScript payloads hidden within SVG elements like <desc>, <style>, or <noscript>.
  3. The attacker uploads or inputs this malicious SVG content into the SiYuan application, exploiting either a stored or reflected XSS vector.
  4. SiYuan's SVG sanitization mechanism fails to properly neutralize the embedded script tags, as its HTML parser-based cleaner is bypassed.
  5. When a victim user subsequently views or interacts with the content containing the malicious SVG within the SiYuan application, their browser requests and renders the SVG as image/svg+xml.
  6. The victim's browser interprets and executes the embedded script within the application's origin, allowing the attacker to perform actions such as stealing session cookies, redirecting the user, or defacing the application interface.

Impact

The successful exploitation of CVE-2026-66394 can lead to severe consequences, including unauthorized access to user accounts through session hijacking, sensitive data exfiltration from the application, or defacement of content. Given the CVSS v3.1 base score of 8.7 (High), this vulnerability presents a significant risk. Attackers, once authenticated, could leverage this to compromise other user sessions, manipulate displayed content, or launch further attacks within the affected application's trust boundary. As a personal knowledge management system, SiYuan often stores sensitive personal or organizational data, making such a compromise highly impactful for individual users and potentially for organizations relying on the platform.

Recommendation

  • Upgrade SiYuan to version 3.7.3 or newer immediately to mitigate the vulnerabilities described in CVE-2026-66394.
  • Implement robust input validation and output encoding for all user-supplied content, especially when handling SVG files, to prevent similar bypasses in web applications.
  • Ensure that content security policies (CSPs) are configured to restrict script execution sources to trusted domains, limiting the potential impact of client-side scripting vulnerabilities.
]]>highadvisoryxssweb-applicationvulnerabilitysvg-sanitization