SiYuan is a personal knowledge management system. In versions 3.6.0 and below, SanitizeSVG has an incomplete blocklist — it blocks data:text/html and data:image/svg+xml in href attributes but misses data:text/xml and data:application/xml, both of which can render SVG with JavaScript execution. The unauthenticated /api/icon/getDynamicIcon endpoint serves user-controlled input (via the content parameter) directly into SVG markup using fmt.Sprintf with no escaping, served as Content-Type: image/svg+xml. This creates a click-through XSS: a victim navigates to a crafted URL, sees an SVG with an injected link, and clicking it triggers JavaScript via the bypassed MIME types. The attack requires direct navigation to the endpoint or <object>/<embed> embedding, since <img> tag rendering in the frontend doesn't allow interactive links. This issue has been fixed in version 3.6.1.
The SanitizeSVG function blocks data:text/html and data:image/svg+xml MIME types in href attributes, but overlooks data:text/xml and data:application/xml — both of which allow SVG rendering with JavaScript execution. The unsecured endpoint /api/icon/getDynamicIcon (accessible without authentication) injects user input from the content parameter directly into SVG tags using fmt.Sprintf without any escaping, serving the result with the Content-Type: image/svg+xml header. The attack occurs as click-through XSS: the victim opens a crafted URL or visits a page with an embedded <object> or <embed> element, sees an SVG with an injected link, and clicking it triggers JavaScript execution through the bypassed MIME types.
An attacker can execute arbitrary JavaScript code in the context of the victim's browser, potentially enabling data theft, session hijacking, or performing further actions on behalf of the user.
SiYuan should be updated to version 3.6.1, in which the vulnerability has been fixed. The patch is available in the official project repository (commit d01d561875d4f744e9f6232f1d4831e3642b8696) and in release v3.6.1.
B3Log SiYuan in versions 3.6.0 and earlier
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NB3log Siyuan
APPB3Log< 3.6.1
Related vulnerabilities
B3Log SiYuan: XSS w diagramach Mermaid eskaluje do RCE w Electron
RCE przez stored XSS w kliencie desktopowym B3Log SiYuan
RCE w SiYuan poprzez nadmiernie permisywną politykę CORS
Stored XSS → RCE w B3Log SiYuan via złośliwy URL w Attribute View
Path Traversal w B3Log SiYuan — nieautoryzowane odczytywanie struktury plików