CVE-2026-34605

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34605
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34605.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34605
Aliases
Published
2026-03-31T21:50:10.076Z
Modified
2026-04-02T13:30:41.824803Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )
Details

SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function introduced in version 3.6.0 to fix XSS in the unauthenticated /api/icon/getDynamicIcon endpoint can be bypassed by using namespace-prefixed element names such as <x:script xmlns:x="http://www.w3.org/2000/svg">. The Go HTML5 parser records the element's tag as "x:script" rather than "script", so the tag check passes it through. The SVG is served with Content-Type: image/svg+xml and no Content Security Policy; when a browser opens the response directly, its XML parser resolves the prefix to the SVG namespace and executes the embedded script. This issue has been patched in version 3.6.2.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34605.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/siyuan-note/siyuan

Affected ranges

Type
GIT
Repo
https://github.com/siyuan-note/siyuan
Events
Introduced
fd6526133bb318d534b8865998f8059ae765fdd1
Fixed
29b104f338f9b0cdda0df852871a09a6268ced2f
Database specific 
{
    "versions": [
        {
            "introduced": "3.6.0"
        },
        {
            "fixed": "3.6.2"
        }
    ]
}

Affected versions

v3.*
v3.6.0
v3.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34605.json"