CNNVD-202601-2760 Information
Jan 16, 2026
cve
CNNVD ID
CNNVD-202601-2760
Related CVE
- CNNVD Published: 2026-01-16
Description (Chinese)
SiYuan是SiYuan开源的一个隐私至上的个人知识管理系统。 SiYuan 3.5.4-dev2之前版本存在跨站脚本漏洞，该漏洞源于未清理上传的SVG文件，可能导致存储型跨站脚本攻击。
Description (English)
SiYuan is an open-source, private, personal knowledge management system. The pre-SiYuan 3.5.4-dev2 version had a cross-site script loophole, which originated from uncleaned uploaded SVG files and could lead to storage-type cross-site script attacks.
Hazard Level
High
Vulnerability Type
跨站脚本
Affected Vendor
SiYuan
Published
2026-01-16
Last Modified
2026-02-24
References
https://github.com/siyuan-note/siyuan/commit/11115da3d0de950593ee4ce375cf7f9018484388 https://github.com/siyuan-note/siyuan/issues/16844 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pcjq-j3mq-jv5j https://access.redhat.com/security/cve/cve-2026-23645
Patch
https://github.com/siyuan-note/siyuan/releases
Share on: