6.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31809

CVE-2026-31809: SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS

SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) checks href attributes for the javascript: prefix using strings.HasPrefix(). However, inserting ASCII tab ( ), newline ( ), or carriage return ( ) characters inside the javascript: string bypasses this prefix check. Browsers strip these characters per the WHATWG URL specification before parsing the URL scheme, so the JavaScript still executes. This allows an attacker to inject executable JavaScript into the unauthenticated /api/icon/getDynamicIcon endpoint, creating a reflected XSS. This is a second bypass of the fix for CVE-2026-29183 (fixed in v3.5.9). This vulnerability is fixed in 3.5.10.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31809

CVE-2026-31809:

6.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/siyuan-note/siyuan/kernel	go	< 0.0.0-20260310025236-297bd526708f	0.0.0-20260310025236-297bd526708f

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the SanitizeSVG function located in the kernel/util/misc.go file. The root cause is an incomplete sanitization process for SVG content, specifically within href attributes. The code checked for the javascript: prefix using strings.HasPrefix, but this check could be bypassed by injecting whitespace characters (like tabs, newlines, or carriage returns) into the javascript: string (e.g., java	script:). While the Go strings.HasPrefix check would fail, browsers would strip these characters before parsing the URL, thus executing the embedded JavaScript. The fix, identified in commit 257aa0ef4439a9209fcb930a946740350811da9a, involves adding a step to explicitly remove these whitespace characters from the attribute value before the security checks are performed. This ensures that such bypass techniques are no longer effective. The vulnerable function, util.SanitizeSVG, would be the primary indicator in a runtime profile during exploitation.

Vulnerable functions

util.SanitizeSVG

kernel/util/misc.go

The `SanitizeSVG` function was vulnerable to an XSS attack. The sanitizer used `strings.HasPrefix` to check for "javascript:" in `href` attributes. However, it did not account for whitespace characters (tab, newline, carriage return) that could be inserted within the "javascript:" string (e.g., "java\tscript:"). Browsers would strip these whitespace characters before processing the URL, leading to the execution of the malicious JavaScript. The patch fixes this by removing these whitespace characters before performing the prefix check.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.