Known CVE

SiYuan <= v3.5.9 - SVG Animate Element XSS

SiYuan <= v3.5.9 contains a reflected XSS caused by insufficient SVG sanitization allowing SVG animation elements to inject executable JavaScript in /api/icon/getDynamicIcon endpoint, letting unauthenticated attackers execute scripts.

CVE-2026-31807

Medium2026CVSS 6.1CWE-79

cve2026 · siyuan · xss · svg · reflected · unauth

Verified scans run this check after you prove you own the site.

All known CVEs View the checks catalog National Vulnerability Database

Scan a website