CVE-2026-66394 SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass
Authenticated attackers can execute arbitrary scripts in SiYuan by bypassing SVG sanitization, potentially compromising user sessions and data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-66394?
CVE-2026-66394 is a critical cross-site scripting vulnerability in siyuan-note siyuan, published on 27 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML parser treats as raw text but browsers interpret as executable SVG content when served as image/svg+xml, enabling script execution in the application origin.
Weakness: CWE-79
Which versions are affected by CVE-2026-66394?
3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel.
| Package | Affected | Fixed in |
|---|---|---|
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260714095344-f08dee71ba8e |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260714095344-f08dee71ba8e |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260714095344-f08dee71ba8e |
How do I fix CVE-2026-66394?
Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260714095344-f08dee71ba8e or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-66394 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-66394 exists.
Sources
Also known as GHSA-5p6m-3744-5c8g, GHSA-99rq-75j6-5j9f, GO-2026-6364.