https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 01:27:59 +0000 https://cve.radiocsirt.org/vuln/cve-2026-34605 <p><strong>Affected:</strong> siyuan-note siyuan</p> <p>SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function introduced in version 3.6.0 to fix XSS in the unauthenticated /api/icon/getDynamicIcon endpoint can be bypassed by using namespace-prefixed element names such as &lt;x:script xmlns:x=&#34;http://www.w3.org/2000/svg&#34;&gt;. The Go HTML5 parser records the element&#39;s tag as &#34;x:script&#34; rather than &#34;script&#34;, so the tag check passes it through. The SVG is served with Content-Type: image/svg+xml and no Content Security Policy; when a browser opens the response directly, its XML parser resolves the prefix to the SVG namespace and executes the embedded script. This issue has been patched in version 3.6.2.</p> <p><strong>Affected:</strong> siyuan-note siyuan</p> <p>SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function introduced in version 3.6.0 to fix XSS in the unauthenticated /api/icon/getDynamicIcon endpoint can be bypassed by using namespace-prefixed element names such as &lt;x:script xmlns:x=&#34;http://www.w3.org/2000/svg&#34;&gt;. The Go HTML5 parser records the element&#39;s tag as &#34;x:script&#34; rather than &#34;script&#34;, so the tag check passes it through. The SVG is served with Content-Type: image/svg+xml and no Content Security Policy; when a browser opens the response directly, its XML parser resolves the prefix to the SVG namespace and executes the embedded script. This issue has been patched in version 3.6.2.</p> https://cve.radiocsirt.org/vuln/cve-2026-34605