{"id":"CVE-2026-31807","published":"2026-03-10T20:56:57Z","modified":"2026-03-11T16:00:25Z","title":"SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS","vendor":"siyuan-note","product":"siyuan","tier":"tail","description":{"text":"SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) blocks dangerous elements (<script>, <iframe>, <foreignobject>) and removes on* event handlers and javascript: in href attributes. However, it does NOT block SVG animation elements (<animate>, <set>) which can dynamically set attributes to dangerous values at runtime, bypassing the static sanitization. This allows an attacker to inject executable JavaScript into the unauthenticated /api/icon/getDynamicIcon endpoint (type=8), creating a reflected XSS. This is a bypass of the fix for CVE-2026-29183 (fixed in v3.5.9). This vulnerability is fixed in v3.5.10.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.4,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00455,"percentile":0.39406,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5hc8-qmg8-pw27","tags":["x_refsource_CONFIRM"]}],"priority":{"score":17.4,"factors":[{"name":"EPSS percentile","points":7.88},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":4.48}]},"exploitSources":{"nuclei":[{"id":"CVE-2026-31807","name":"SiYuan <= v3.5.9 - SVG Animate Element XSS","severity":"medium","path":"http/cves/2026/CVE-2026-31807.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-31807.yaml"}],"provenance":"source"},"vendorSlug":"siyuan-note","affectedVersions":[{"vendor":"siyuan-note","product":"siyuan","versions":["< 3.5.10"]}],"affected":[{"ecosystem":"Go","package":"github.com/siyuan-note/siyuan/kernel","vulnerableRanges":["<0.0.0-20260310025236-297bd526708f"],"patched":["0.0.0-20260310025236-297bd526708f"],"from":["GHSA-5hc8-qmg8-pw27","GO-2026-4667"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-10892","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-siyuan-note-siyuan-cve-2026-29183","parents":[{"from":"CVE-2026-29183","to":"CVE-2026-31807","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"This is a bypass of the fix for CVE-2026-29183 (fixed in v3.5.9).","from":"CVE.org","in":"CVE-2026-31807"},{"kind":"version-step","provenance":"source","package":"Go:github.com/siyuan-note/siyuan/kernel","fromFixed":"0.0.0-20260304034809-d68bd5a79391","toFixed":"0.0.0-20260310025236-297bd526708f","daysApart":4},{"kind":"similar","provenance":"machine","score":0.4,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2026-23850","published":"2026-01-19","fixed":"0.0.0-20260118092326-b2274baba2e1","kev":false},{"cve":"CVE-2026-23851","published":"2026-01-19","fixed":"0.0.0-20260118092521-f8f4b517077b","kev":false},{"cve":"CVE-2026-29183","published":"2026-03-06","fixed":"0.0.0-20260304034809-d68bd5a79391","kev":false},{"cve":"CVE-2026-31807","published":"2026-03-10","fixed":"0.0.0-20260310025236-297bd526708f","kev":false},{"cve":"CVE-2026-31809","published":"2026-03-10","fixed":"0.0.0-20260310025236-297bd526708f","kev":false},{"cve":"CVE-2026-33066","published":"2026-03-20","fixed":"0.0.0-20260314111550-b382f50e1880","kev":false,"link":{"from":"CVE-2026-31807","to":"CVE-2026-33066","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/siyuan-note/siyuan/kernel","fromFixed":"0.0.0-20260310025236-297bd526708f","toFixed":"0.0.0-20260314111550-b382f50e1880","daysApart":10}]}},{"cve":"CVE-2026-33067","published":"2026-03-20","fixed":"0.0.0-20260317012524-fe4523fff2c8","kev":false}],"package":"Go:github.com/siyuan-note/siyuan/kernel"}}