CVE-2026-32940 - Vulnerability Analysis

Overview

SiYuan <= 3.6.0 contains a stored XSS caused by incomplete SanitizeSVG blocklist missing data:text/xml and data:application/xml in href attributes in /api/icon/getDynamicIcon endpoint, letting unauthenticated attackers execute JavaScript via crafted SVG links, exploit requires victim to navigate or embed the crafted SVG.

Severity & Score

Impact

Unauthenticated attackers can execute JavaScript in victim's browser via crafted SVG links, leading to potential session hijacking or other client-side attacks.

Mitigation

Update to version 3.6.1 or later.

References

• https://github.com/advisories/GHSA-6865-qjcf-286f
• https://github.com/siyuan-note/siyuan/commit/d01d561875d4f744e9f6232f1d4831e3642b8696
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4mx9-3c2h-hwhg

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 20, 2026

🔴 CVE-2026-32940 - Critical (9.3) SiYuan is a personal knowledge management system. In versions 3.6.0 and below, SanitizeSVG has an incomplete blocklist — it blocks data:text/html and data:image/svg+xml in href attributes but misses data:text/xml and data:application/xml, both o... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32940/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner