Vulnerability · Published Jul 27, 2026 · Assigned by VulnCheck

CVE-2026-66394SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass

High 8.7

In plain English

A high-severity cross-site scripting in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)0.3%top 72.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML parser treats as raw text but browsers interpret as executable SVG content when served as image/svg+xml, enabling script execution in the application origin.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/siyuan-note/siyuan/kernel	0.0.0-20260714095344-f08dee71ba8e	GHSA-99rq-75j6-5j9f
Go	github.com/siyuan-note/siyuan/kernel	0.0.0-20260714095344-f08dee71ba8e	GO-2026-6364

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	0 – before 3.7.3

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-99rq-75j6-5j9f) vendor-advisory
VulnCheck Advisory: SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass third-party-advisory