SiYuan <= v3.5.9 - Cross Site Scripting
CVE-2026-31809
Verified
Description
SiYuan v3.5.10 contains a reflected XSS caused by improper sanitization of javascript: href attributes allowing ASCII control characters to bypass prefix checks in SVG sanitizer, letting unauthenticated attackers execute JavaScript via /api/icon/getDynamicIcon.
Severity
Medium
CVSS Score
6.1
Exploit Probability
1%
Affected Product
siyuan
Published Date
April 2, 2026
Template Author
0x_akoko
CVE-2026-31809.yaml
6.1Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVE ID:
cve-2026-31809
CWE ID:
cwe-79
Remediation Steps
Update to version 3.5.10 or later.