THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-99rq-75j6-5j9f (high) — SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass

[GHSA] GHSA-99rq-75j6-5j9f (high) — SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass

highgithub_advisoriesPublished 2026-09-03

GHSA-99rq-75j6-5j9f Severity: high CVE: None

SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass

### Summary SiYuan cleans user supplied SVG with `util.SanitizeSVG` before it serves the file inline as `image/svg+xml`. This cleaner is the guard behind the `Editor.AllowSVGScript` setting, which is off by default, so a `<script>` inside an SVG is meant to be removed.

The cle

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

http://127.0.0.1:6806/api/icon/getDynamicIconurl
https://attacker.example/?url

Original source: https://github.com/advisories/GHSA-99rq-75j6-5j9f