CVE-2026-31809 Scanner

SiYuan is a software application used widely by individuals and organizations for managing notes and documentation. It is designed to help users organize their thoughts and knowledge efficiently. The platform is utilized in educational and professional settings to foster collaboration and information sharing. SiYuan facilitates the creation and structuring of digital content, making it valuable for various research and development fields. Its user interface provides a seamless experience for content management and retrieval. The software is crucial in environments where documentation and note-taking are integral to daily operations.

The detected vulnerability is a Cross-Site Scripting (XSS) issue found in SiYuan versions up to 3.5.9. XSS vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking or other client-side attacks. This vulnerability arises due to improper sanitization of JavaScript href attributes in the SVG sanitizer. Unauthenticated attackers can exploit this weakness to execute arbitrary JavaScript in the browsers of users accessing the compromised SiYuan instance. It poses a significant risk of unauthorized data access and session manipulation.

The technical details surrounding this vulnerability involve the improper handling of href attributes in SVG elements, allowing ASCII control characters to bypass security checks. Attackers craft malicious input to exploit the /api/icon/getDynamicIcon endpoint in SiYuan, triggering unsafe script execution. The vulnerable parameter pertains to how dynamic icons are retrieved utilizing unsafe JavaScript execution paths. Furthermore, the exploit involves sending a crafted request to the affected endpoint, which, when accessed by a victim's browser, executes the attacker's injected script.

The possible effects of this vulnerability being exploited include unauthorized access to user sessions and sensitive information. Attackers could hijack user sessions, leading to potential identity theft or data manipulation. Additionally, it could serve as a gateway for conducting further client-side attacks and spreading malware. Exploitation of this issue undermines trust in the affected SiYuan environments, posing privacy and security risks to users. It is crucial to address this issue promptly to maintain the security integrity of systems using the affected version.

REFERENCES

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pmc9-f5qr-2pcr
• https://nvd.nist.gov/vuln/detail/CVE-2026-31809