CVE-2026-23645: SiYuan Has a Stored Cross-Site Scripting (XSS) Vulnerability via Unrestricted SVG File Upload

January 16, 2026 (updated January 21, 2026)

A Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file (e.g., imported from an untrusted source), arbitrary JavaScript code is executed in the context of their authenticated session.

References

github.com/advisories/GHSA-pcjq-j3mq-jv5j
github.com/siyuan-note/siyuan
github.com/siyuan-note/siyuan/commit/11115da3d0de950593ee4ce375cf7f9018484388
github.com/siyuan-note/siyuan/issues/16844
github.com/siyuan-note/siyuan/security/advisories/GHSA-pcjq-j3mq-jv5j
nvd.nist.gov/vuln/detail/CVE-2026-23645

Code Behaviors & Features

Detect and mitigate CVE-2026-23645 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →