Known CVE

SiYuan <= v3.5.9 - Cross Site Scripting

SiYuan v3.5.10 contains a reflected XSS caused by improper sanitization of javascript: href attributes allowing ASCII control characters to bypass prefix checks in SVG sanitizer, letting unauthenticated attackers execute JavaScript via /api/icon/getDynamicIcon.

CVE-2026-31809

Medium2026CVSS 6.1CWE-79

cve2026 · siyuan · xss · bypass

Verified scans run this check after you prove you own the site.

All known CVEs View the checks catalog National Vulnerability Database

Scan a website