CVE-2026-66394
SiYuan versions earlier than 3.7.3 have a flaw that lets logged‑in users run malicious scripts hidden inside SVG files. The issue arises because the SVG sanitizer fails to strip scripts placed in certain elements, so browsers execute them when the file is served as image/svg+xml. This can lead to code execution within the application’s context.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of SiYuan before version 3.7.3 who can upload or view SVG images, especially those with authenticated access to the application.
Real-world impact
An attacker who can log into the application could embed a malicious script in an SVG file, causing the browser to run that script as if it were part of the SiYuan web page. This could allow the attacker to steal session cookies, read or modify data, or perform actions on behalf of the user.
Why this severity
The CVSS score of 9.3 reflects a high impact (confidentiality, integrity, availability) combined with low attack complexity and the need for user authentication. The vulnerability allows arbitrary code execution in the application’s origin, which is why it is rated critical.
What to do about it
- ›Avoid uploading or displaying SVG files from untrusted sources until a patch is released.
- ›Disable SVG support in the application if possible.
- ›Use a stricter SVG sanitizer or remove the vulnerable elements (desc, style, noscript) from uploaded files.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources