---
id: CVE-2026-66394
title: >-
  SiYuan before v3.7.3 contains stored and reflected cross-site scripting
  vulnerabilities in SVG sanitization that allows authenticated attackers to
  execute scripts by bypassing the HTML parser-based cleaner
summary: >-
  SiYuan before v3.7.3 contains stored and reflected cross-site scripting
  vulnerabilities in SVG sanitization that allows authenticated attackers to
  execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide
  script tags…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'
cwe:
  - CWE-79
vendor: siyuan-note
product: siyuan
affected:
  - siyuan < 3.7.3
patched:
  - github.com/siyuan-note/siyuan/kernel 0.0.0-20260714095344-f08dee71ba8e
published: '2026-07-27'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:17:30.180'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66394'
references:
  - url: >-
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-99rq-75j6-5j9f
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/siyuan-before-stored-and-reflected-xss-via-svg-sanitizer-bypass
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-99rq-75j6-5j9f
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://github.com/siyuan-note/siyuan/commit/f08dee71ba8e087a395d74f121de11e6a997ef14
  - url: 'https://github.com/siyuan-note/siyuan'
  - url: 'https://github.com/siyuan-note/siyuan/releases/tag/v3.7.3'
tags:
  - nvd
  - cve.org
  - exploit-available
  - osv
  - go
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-27T17:58:40.465603Z'
epss: 0.00337
epssPercentile: 0.26907
aliases:
  - GHSA-99rq-75j6-5j9f
ecosystem: go
ingestedAt: '2026-09-03T19:32:13.215Z'
---

## Overview

SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML parser treats as raw text but browsers interpret as executable SVG content when served as image/svg+xml, enabling script execution in the application origin.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-66394)

Affected packages:

- `github.com/siyuan-note/siyuan/kernel < 0.0.0-20260714095344-f08dee71ba8e`

Patched in:

- `github.com/siyuan-note/siyuan/kernel 0.0.0-20260714095344-f08dee71ba8e`

Source: https://osv.dev/vulnerability/GHSA-99rq-75j6-5j9f