Platform
go
Component
github.com/siyuan-note/siyuan
Fixed in
3.6.2
0.0.1
CVE-2026-32940 describes a critical SVG injection vulnerability in Siyuan Note, a knowledge management application. This bypass circumvents the intended sanitization of SVG content, enabling attackers to inject malicious JavaScript code. The vulnerability affects versions of Siyuan Note prior to 0.0.0-20260313024916-fd6526133bb3 and is addressed in version 3.6.1.
An attacker can exploit this vulnerability by crafting a malicious SVG image embedded within a data:text/xml or data:application/xml URL and sending it to the /api/icon/getDynamicIcon endpoint. Because this endpoint is unauthenticated, no authentication is required to trigger the vulnerability. The injected JavaScript code will then execute within the user's browser context when the SVG is rendered, potentially leading to information disclosure, session hijacking, or even complete account takeover. The impact is particularly severe because Siyuan Note is often used to store sensitive information, making the potential data breach significant. This vulnerability shares similarities with other SVG injection flaws where improper sanitization allows for the execution of arbitrary code.
CVE-2026-32940 was publicly disclosed on 2026-03-17. The vulnerability is considered high probability due to the ease of exploitation and the lack of authentication required. Public proof-of-concept (PoC) code is likely to emerge, increasing the risk of widespread exploitation. The vulnerability is related to an incomplete fix for CVE-2026-29183, suggesting that similar vulnerabilities might exist in other parts of the application. Check CISA KEV for updates.
Exploit Status
EPSS
0.06% (18% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-32940 is to immediately upgrade Siyuan Note to version 3.6.1 or later. If upgrading is not immediately feasible due to compatibility issues or downtime concerns, consider implementing a Web Application Firewall (WAF) rule to block requests containing data:text/xml or data:application/xml in the content parameter of the /api/icon/getDynamicIcon endpoint. Additionally, carefully review any third-party plugins or extensions for Siyuan Note, as they may introduce similar vulnerabilities. After upgrading, confirm the fix by attempting to load a known malicious SVG payload via the /api/icon/getDynamicIcon endpoint and verifying that the JavaScript execution is blocked.
Actualice SiYuan a la versión 3.6.1 o superior. Esta versión corrige la vulnerabilidad de Cross-Site Scripting (XSS) al sanear correctamente las entradas SVG y evitar la ejecución de JavaScript no deseado.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-32940 is a critical vulnerability in Siyuan Note that allows attackers to inject malicious JavaScript code via a bypass in the SanitizeSVG function, affecting versions prior to 3.6.1.
You are affected if you are using Siyuan Note versions prior to 3.6.1. Check your version and upgrade immediately.
Upgrade Siyuan Note to version 3.6.1 or later. As a temporary workaround, implement a WAF rule to block requests containing data:text/xml.
While no active exploitation has been confirmed, the vulnerability is considered high probability and PoCs are likely to emerge, increasing the risk.
Refer to the official Siyuan Note security advisory for details and updates: [https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xxxx-xxxx-xxxx](replace with actual advisory URL)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your go.mod file and we'll tell you instantly if you're affected.