Cloudanix VulnDB

GHSA-4mx9-3c2h-hwhg

Critical · 9.3

SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)

CVSS

9.3

EPSS

—

Published

Mar 17, 2026

CISA due date

—

The record

Reflected XSS on an unauthenticated endpoint. Victim visits the crafted URL, then clicks the injected link in the SVG. No auth needed to craft the URL. Docker deployments where SiYuan is network-accessible are the clearest target -- the endpoint is reachable directly. In the Electron desktop app, impact depends on `nodeIntegration`/`contextIsolation` settings. Issue #15970 ("XSS to RCE") explored that path. The deeper issue: the blocklist approach for data: URIs is fragile. `text/xml` and `application/xml` are the gap today, but other MIME types that render active content could surface. An allowlist of safe image types covers the known vectors and future MIME type additions.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities