EUVD-2026-275549

fkie_cve-2026-31807

SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) blocks dangerous elements (<script>, <iframe>, <foreignobject>) and removes on* event handlers and javascript: in href attributes. However, it does NOT block SVG animation elements (<animate>, <set>) which can dynamically set attributes to dangerous values at runtime, bypassing the static sanitization. This allows an attacker to inject executable JavaScript into the unauthenticated /api/icon/getDynamicIcon endpoint (type=8), creating a reflected XSS. This is a bypass of the fix for CVE-2026-29183 (fixed in v3.5.9). This vulnerability is fixed in v3.5.10.

GHSA-5hc8-qmg8-pw27 — SiYuan has a SVG Sanitizer Bypass via `` Element — Unauthenticated XSS

Affected: Go: github.com/siyuan-note/siyuan/kernel

# SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS

## Summary

SiYuan's SVG sanitizer (`SanitizeSVG`) blocks dangerous elements (`<script>`, `<iframe>`, `<foreignobject>`) and removes `on*` event handlers and `javascript:` in `href` attributes. However, it does NOT block SVG animation elements (`<animate>`, `<set>`) which can dynamically set attributes to dangerous values at runtime, bypassing the static sanitization. This allows an attacker to inject executable JavaScript into the unauthenticated `/api/icon/getDynamicIcon` endpoint (type=8), creating a reflected XSS.

This is a bypass of the fix for CVE-2026-29183 (fixed in v3.5.9).

## Affected Component

- **File:** `kernel/util/misc.go` - **Function:** `SanitizeSVG()` (lines 234-319) - **Endpoint:** `GET /api/icon/getDynamicIcon?type=8&content=...` (unauthenticated) - **Version:** SiYuan <= 3.5.9

## Root Cause

The sanitizer checks attributes on elements at **parse time**. SVG `<animate>` and `<set>` elements modify attributes **at runtime** — these elements are not in the sanitizer's blocklist.

### Sanitizer's blocklist (line 250)

```go if tag == "script" || tag == "iframe" || tag == "object" || tag == "embed" || tag == "foreignobject" { n.RemoveChild(c) // ... } ```

Missing from blocklist: `animate`, `set`, `animateTransform`, `animateMotion`

### Attribute check (lines 264-267)

```go // Only checks static attributes if strings.HasPrefix(key, "on") { continue } ```

The `<animate>` e…

Most recent entries from all

EUVD-2026-275549

fkie_cve-2026-31807

GHSA-5hc8-qmg8-pw27 — SiYuan has a SVG Sanitizer Bypass via `` Element — Unauthenticated XSS