SiYuan <= v3.5.9 - SVG Animate Element XSS
CVE-2026-31807
Verified
Description
SiYuan <= v3.5.9 contains a reflected XSS caused by insufficient SVG sanitization allowing SVG animation elements to inject executable JavaScript in /api/icon/getDynamicIcon endpoint, letting unauthenticated attackers execute scripts.
Severity
Medium
CVSS Score
6.1
Exploit Probability
1%
Affected Product
siyuan
Published Date
April 2, 2026
Template Author
0x_akoko
CVE-2026-31807.yaml
6.1Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVE ID:
cve-2026-31807
CWE ID:
cwe-79
Remediation Steps
Update to version 3.5.10 or later.