6.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31807

CVE-2026-31807: SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS

SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) blocks dangerous elements (<script>, <iframe>, <foreignobject>) and removes on* event handlers and javascript: in href attributes. However, it does NOT block SVG animation elements (<animate>, <set>) which can dynamically set attributes to dangerous values at runtime, bypassing the static sanitization. This allows an attacker to inject executable JavaScript into the unauthenticated /api/icon/getDynamicIcon endpoint (type=8), creating a reflected XSS. This is a bypass of the fix for CVE-2026-29183 (fixed in v3.5.9). This vulnerability is fixed in v3.5.10.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31807

CVE-2026-31807:

6.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/siyuan-note/siyuan/kernel	go	< 0.0.0-20260310025236-297bd526708f	0.0.0-20260310025236-297bd526708f

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the SanitizeSVG function in kernel/util/misc.go. The function's purpose is to sanitize SVG input to prevent XSS attacks. However, it failed to block certain SVG animation tags like <animate> and <set>. An attacker could exploit this by crafting an SVG file with these tags to dynamically set attributes to malicious values at runtime, for instance, setting an href attribute to a javascript: URL. This would bypass the static checks performed by the sanitizer. The fix, identified in commit 9c4b184bef924f76b4f036663111246f5fb7c95f, directly modifies the SanitizeSVG function to include these animation tags in its blocklist, and also adds checks for javascript: payloads in animation-related attributes. Therefore, util.SanitizeSVG is the vulnerable function.

Vulnerable functions

util.SanitizeSVG

kernel/util/misc.go

The `SanitizeSVG` function is responsible for sanitizing SVG input. The vulnerability existed because this function did not have a comprehensive blocklist for dangerous SVG tags. Specifically, it missed animation-related tags such as `<animate>`, `<set>`, `<animateTransform>`, and `<animateMotion>`. This allowed an attacker to craft a malicious SVG that, when rendered, would execute JavaScript. The patch addresses this by adding these tags to the blocklist within the `SanitizeSVG` function, thus preventing them from being rendered.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.