CVE-2026-66394 in SiYuan
Summary
by MITRE • 07/27/2026
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML parser treats as raw text but browsers interpret as executable SVG content when served as image/svg+xml, enabling script execution in the application origin.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability exists within SiYuan version 3.7.2 and earlier, representing a critical stored and reflected cross-site scripting flaw that specifically targets the application's SVG sanitization mechanism. This security weakness allows authenticated attackers to inject malicious scripts into the system by exploiting a fundamental parsing inconsistency between HTML parsers and browser rendering engines. The vulnerability stems from the application's reliance on an HTML parser-based cleaner that fails to properly sanitize SVG content, creating a pathway for attackers to bypass intended security measures.
The technical implementation of this flaw involves manipulating SVG elements in ways that exploit the difference in how HTML parsers treat certain tags versus how browsers render them. Attackers can embed script tags within desc, style, or noscript elements where the HTML parser treats these as raw text content while browsers interpret them as executable SVG markup when served with image/svg+xml MIME type. This parsing inconsistency creates a vector for code execution within the application's origin context, effectively allowing attackers to establish persistent malicious payloads that can execute in the victim's browser session.
The operational impact of this vulnerability extends beyond simple script injection, as authenticated attackers can leverage it to perform a wide range of malicious activities including session hijacking, data exfiltration, and privilege escalation. The stored nature of the vulnerability means that once an attacker successfully injects malicious content, it persists within the application's storage mechanisms and can affect multiple users who view the compromised content. This creates a particularly dangerous scenario where attackers can establish long-term footholds within the system while maintaining access to sensitive user data and application functionality.
The security implications align with CWE-79, which specifically addresses cross-site scripting vulnerabilities, and maps to ATT&CK technique T1566.001 for initial access through malicious content. The vulnerability demonstrates a classic case of improper input validation where the sanitization process fails to account for the different parsing contexts between HTML and SVG rendering engines. Organizations using SiYuan versions prior to 3.7.3 face significant risk exposure, particularly in environments where users have elevated privileges or access to sensitive data.
Mitigation strategies should focus on implementing comprehensive SVG sanitization that accounts for browser rendering behavior rather than relying solely on HTML parser-based cleaning. The recommended solution involves upgrading to SiYuan version 3.7.3 or later, which includes enhanced SVG content validation and proper handling of potentially dangerous elements within SVG markup. Additionally, organizations should implement strict content security policies that limit script execution capabilities and consider implementing additional input validation layers that specifically target SVG elements to prevent similar vulnerabilities from manifesting in other applications.
The vulnerability underscores the importance of understanding how different parsing engines handle content and the critical need for comprehensive sanitization approaches that account for multiple rendering contexts. Security teams should conduct thorough assessments of their SVG handling mechanisms and implement robust testing procedures that validate both parser-based and browser-rendered interpretations of potentially dangerous content to prevent similar issues from occurring in other applications that process user-supplied SVG data.