SiYuan, a personal knowledge management system, had an XSS vulnerability (CWE-79) in versions 3.6.0 up to but not including 3.6.2. The SanitizeSVG function introduced to mitigate XSS in the unauthenticated /api/icon/getDynamicIcon endpoint was bypassable by using namespace-prefixed element names such as <x:script xmlns:x="http://www.w3.org/2000/svg">. The Go HTML5 parser records the tag as "x:script" rather than "script", allowing the malicious script to pass the tag check. When the SVG is served with Content-Type: image/svg+xml and no Content Security Policy, browsers resolve the prefix and execute the embedded script. The vulnerability is patched in version 3.6.2.

This vulnerability allows an attacker to execute arbitrary scripts in the context of the victim's browser when the malicious SVG is opened directly. This can lead to high-impact consequences such as theft of sensitive information or session hijacking. The CVSS 4.0 base score is 8.6 (high severity), reflecting network attack vector, no privileges required, user interaction needed, and high impact on confidentiality and integrity.

Upgrade SiYuan to version 3.6.2 or later, where this vulnerability is patched. Since this is a self-hosted product (not a cloud service), users must apply the update themselves. No other mitigations are indicated by the vendor advisory.