https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-24T11:09:37.955286+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-265998 EUVD-2026-265998 2026-10-24T11:09:37.957591+00:00 EUVD-2026-265998 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23645 fkie_cve-2026-23645 2026-10-24T11:09:37.957624+00:00

SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file (e.g., imported from an untrusted source), arbitrary JavaScript code is executed in the context of their authenticated session. This vulnerability is fixed in 3.5.4-dev2.

 https://cve.radiocsirt.org/vuln/ghsa-pcjq-j3mq-jv5j GHSA-pcjq-j3mq-jv5j — SiYuan Has a Stored Cross-Site Scripting (XSS) Vulnerability via Unrestricted SVG File Upload 2026-10-24T11:09:37.957655+00:00

Affected: Go: github.com/siyuan-note/siyuan/kernel

### Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file (e.g., imported from an untrusted source), arbitrary JavaScript code is executed in the context of their authenticated session.

### Details The application allows authenticated users to upload files, including .svg images, without sanitizing the input to remove embedded JavaScript code (such as <script> tags or event handlers).

### PoC 1. Create a new "Daily note" in the workspace. <img width="1287" height="572" alt="image" src="https://github.com/user-attachments/assets/3a4389b9-695d-4e1b-94dc-72efdb047aa9" /> 2. Create a file named test.svg with malicious JavaScript inside:

``` <svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 124 124" fill="none"> <rect width="124" height="124" rx="24" fill="red"/> <script type="text/javascript"> alert(window.origin); </script> </svg> ``` 3. Upload a file in current daily note: <img width="1617" height="316" alt="image" src="https://github.com/user-attachments/assets/6e14318a-08ec-48e5-b278-9174ad17cfcb" /> <img width="1482" height="739" alt="image" src="https://github.com/user-attachments/assets/95c996e8-5591-436a-9467-ab56c9ffbde0" /> <img width="1321" height="548" alt="image" src="https://github.com/user-attachments/assets/249fb187-3caa-4372-a9c9-56dfda6b8a8f" /> 4. Open the file:

- Right-click the upload…