https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 11:09:26 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-265998 EUVD-2026-265998 https://cve.radiocsirt.org/vuln/euvd-2026-265998 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23645 <p>SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file (e.g., imported from an untrusted source), arbitrary JavaScript code is executed in the context of their authenticated session. This vulnerability is fixed in 3.5.4-dev2.</p> <p>SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file (e.g., imported from an untrusted source), arbitrary JavaScript code is executed in the context of their authenticated session. This vulnerability is fixed in 3.5.4-dev2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23645 https://cve.radiocsirt.org/vuln/ghsa-pcjq-j3mq-jv5j <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file (e.g., imported from an untrusted source), arbitrary JavaScript code is executed in the context of their authenticated session.</p> <p>### Details The application allows authenticated users to upload files, including .svg images, without sanitizing the input to remove embedded JavaScript code (such as &lt;script&gt; tags or event handlers).</p> <p>### PoC 1. Create a new &#34;Daily note&#34; in the workspace. &lt;img width=&#34;1287&#34; height=&#34;572&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/3a4389b9-695d-4e1b-94dc-72efdb047aa9&#34; /&gt; 2. Create a file named test.svg with malicious JavaScript inside:</p> <p>``` &lt;svg xmlns=&#34;http://www.w3.org/2000/svg&#34; width=&#34;200&#34; height=&#34;200&#34; viewBox=&#34;0 0 124 124&#34; fill=&#34;none&#34;&gt; &lt;rect width=&#34;124&#34; height=&#34;124&#34; rx=&#34;24&#34; fill=&#34;red&#34;/&gt; &lt;script type=&#34;text/javascript&#34;&gt; alert(window.origin); &lt;/script&gt; &lt;/svg&gt; ``` 3. Upload a file in current daily note: &lt;img width=&#34;1617&#34; height=&#34;316&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/6e14318a-08ec-48e5-b278-9174ad17cfcb&#34; /&gt; &lt;img width=&#34;1482&#34; height=&#34;739&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/95c996e8-5591-436a-9467-ab56c9ffbde0&#34; /&gt; &lt;img width=&#34;1321&#34; height=&#34;548&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/249fb187-3caa-4372-a9c9-56dfda6b8a8f&#34; /&gt; 4. Open the file:</p> <p>- Right-click the upload…</p> <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file (e.g., imported from an untrusted source), arbitrary JavaScript code is executed in the context of their authenticated session.</p> <p>### Details The application allows authenticated users to upload files, including .svg images, without sanitizing the input to remove embedded JavaScript code (such as &lt;script&gt; tags or event handlers).</p> <p>### PoC 1. Create a new &#34;Daily note&#34; in the workspace. &lt;img width=&#34;1287&#34; height=&#34;572&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/3a4389b9-695d-4e1b-94dc-72efdb047aa9&#34; /&gt; 2. Create a file named test.svg with malicious JavaScript inside:</p> <p>``` &lt;svg xmlns=&#34;http://www.w3.org/2000/svg&#34; width=&#34;200&#34; height=&#34;200&#34; viewBox=&#34;0 0 124 124&#34; fill=&#34;none&#34;&gt; &lt;rect width=&#34;124&#34; height=&#34;124&#34; rx=&#34;24&#34; fill=&#34;red&#34;/&gt; &lt;script type=&#34;text/javascript&#34;&gt; alert(window.origin); &lt;/script&gt; &lt;/svg&gt; ``` 3. Upload a file in current daily note: &lt;img width=&#34;1617&#34; height=&#34;316&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/6e14318a-08ec-48e5-b278-9174ad17cfcb&#34; /&gt; &lt;img width=&#34;1482&#34; height=&#34;739&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/95c996e8-5591-436a-9467-ab56c9ffbde0&#34; /&gt; &lt;img width=&#34;1321&#34; height=&#34;548&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/249fb187-3caa-4372-a9c9-56dfda6b8a8f&#34; /&gt; 4. Open the file:</p> <p>- Right-click the upload…</p> https://cve.radiocsirt.org/vuln/ghsa-pcjq-j3mq-jv5j