Vulnerability Description
SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function introduced in version 3.6.0 to fix XSS in the unauthenticated /api/icon/getDynamicIcon endpoint can be bypassed by using namespace-prefixed element names such as <x:script xmlns:x="http://www.w3.org/2000/svg">. The Go HTML5 parser records the element's tag as "x:script" rather than "script", so the tag check passes it through. The SVG is served with Content-Type: image/svg+xml and no Content Security Policy; when a browser opens the response directly, its XML parser resolves the prefix to the SVG namespace and executes the embedded script. This issue has been patched in version 3.6.2.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| B3Log | Siyuan | >= 3.6.0, < 3.6.2 |
Related Weaknesses (CWE)
References
- https://github.com/siyuan-note/siyuan/issues/17246Issue Tracking
- https://github.com/siyuan-note/siyuan/releases/tag/v3.6.2Release Notes
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-73g7-86qr-jrg3ExploitVendor Advisory
FAQ
What is CVE-2026-34605?
CVE-2026-34605 is a vulnerability with a CVSS score of 6.1 (MEDIUM). SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function introduced in version 3.6.0 to fix XSS in the unauthenticated /api/icon/getDynami...
How severe is CVE-2026-34605?
CVE-2026-34605 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-34605?
Check the references section above for vendor advisories and patch information. Affected products include: B3Log Siyuan.