5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23645

CVE-2026-23645: SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload

SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file (e.g., imported from an untrusted source), arbitrary JavaScript code is executed in the context of their authenticated session. This vulnerability is fixed in 3.5.4-dev2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23645

CVE-2026-23645:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/siyuan-note/siyuan/kernel	go	< 0.0.0-20260116101155-11115da3d0de	0.0.0-20260116101155-11115da3d0de

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored XSS caused by the application serving user-uploaded SVG files without sanitization. The proof-of-concept demonstrates that a malicious SVG file with embedded JavaScript, when uploaded and accessed, executes the script in the user's browser.

The analysis of the patch commit 11115da3d0de950593ee4ce375cf7f9018484388 reveals the exact location of the vulnerability and the fix.

kernel/server/serve.go: The function serveAssets handles HTTP requests for files in the /assets/ directory. Before the patch, it served files directly. The patch modifies serveAssets to delegate the handling of SVG files to a new function, serveSVG.
serveSVG function: This new function, also in kernel/server/serve.go, is responsible for handling SVG files specifically. It reads the SVG file and, by default, passes its content to util.RemoveScriptsInSVG for sanitization before sending it in the HTTP response. This sanitization is only skipped if a new, explicit configuration option allowSVGScript is enabled.
kernel/util/misc.go: This file contains the new RemoveScriptsInSVG function, which is the core of the sanitization logic. It parses the SVG content and removes any <script> tags, effectively neutralizing the XSS vector.

The vulnerable function is server.serveAssets because it was the entry point for serving the unsanitized files. During exploitation, a runtime profile would show this function being executed when the malicious SVG is requested by a user's browser.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.