Siyuan CVE-2026-32940

SiYuan versions 3.6.0 and below. Unauthenticated attacker exploits the /api/icon/getDynamicIcon endpoint with crafted content parameter using data:text/xml or data:application/xml URIs to bypass incomplete SVG sanitization. Victim must click attacker-supplied link to trigger XSS.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) shows network-exploitable attacks with low complexity requiring no privileges but requiring user interaction, with changed scope and high confidentiality and integrity impact. The attack requires two user actions: navigating to a crafted URL and clicking an injected link, which substantially reduces practical exploitation likelihood compared to stored XSS. The unauthenticated attack vector is concerning for public-facing SiYuan instances, but the requirement for direct navigation to the endpoint or specific embedding techniques (object/embed tags) limits widespread exploitation. No KEV listing or EPSS score is provided in the intelligence data, and no proof-of-concept is explicitly mentioned, suggesting limited active exploitation. Real-world risk is moderate-to-high for internet-exposed instances with multiple users, but lower for private or single-user deployments. The Changed Scope rating indicates potential for cross-domain or cross-privilege boundary attacks, elevating risk in multi-tenant scenarios.

An attacker crafts a malicious URL targeting the /api/icon/getDynamicIcon endpoint with a content parameter containing SVG markup with an href attribute using data:text/xml or data:application/xml encoding that embeds JavaScript. The attacker distributes this URL via phishing emails or social engineering to SiYuan users. When a victim clicks the link and then interacts with the rendered SVG element (such as clicking an injected link or button within the image), the JavaScript executes in the context of the SiYuan application, potentially stealing session cookies, performing unauthorized actions, or exfiltrating sensitive knowledge management data.