CVE-2026-66394 describes stored and reflected cross-site scripting vulnerabilities in SiYuan note-taking software prior to version 3.7.3. The issue arises from insufficient sanitization of SVG content, allowing authenticated attackers to embed malicious scripts within SVG elements (desc, style, noscript) that bypass the HTML parser-based cleaner. While these elements appear as raw text to the HTML parser, browsers interpret them as executable SVG content when served as image/svg+xml, leading to script execution within the application's origin. This can compromise the security of the application and its users.

Successful exploitation allows authenticated attackers to execute arbitrary scripts in the context of the SiYuan application origin. This can lead to session hijacking, unauthorized actions, or data theft within the application. The vulnerability affects confidentiality, integrity, and availability as indicated by the high CVSS vector metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, restrict authenticated user privileges to trusted users only and consider disabling SVG content rendering if possible.