CVE-2026-23645

SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file (e.g., imported from an untrusted source), arbitrary JavaScript code is executed in the context of their authenticated session. This vulnerability is fixed in 3.5.4-dev2.

Published Jan 19, 2026

https://github.com/advisories/GHSA-pcjq-j3mq-jv5j https://osv-vulnerabilities.storage.googleapis.com/GIT/CVE-2026-23645.json

CVSS ScoreMedium

6.1

Ecosystem	Package	Version

Ecosystem	Package	Version

Vulnerabilities

CVE-2026-23645

SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file (e.g., imported from an untrusted source), arbitrary JavaScript code is executed in the context of their authenticated session. This vulnerability is fixed in 3.5.4-dev2.

Published Jan 19, 2026

https://github.com/advisories/GHSA-pcjq-j3mq-jv5j https://osv-vulnerabilities.storage.googleapis.com/GIT/CVE-2026-23645.json

CVSS ScoreMedium

6.1


npm	siyuan	0.1.0
npm	siyuan	0.3.12
npm	siyuan	0.3.17
npm	siyuan	0.3.18
npm	siyuan	0.6.1
npm	siyuan	0.7.0
npm	siyuan	0.7.1
npm	siyuan	0.7.2
npm	siyuan	0.7.3
npm	siyuan	0.7.4
npm	siyuan	0.7.5
npm	siyuan	0.7.6
npm	siyuan	0.7.7
npm	siyuan	0.7.8
npm	siyuan	0.7.9
npm	siyuan	0.8.0
npm	siyuan	0.8.1
npm	siyuan	0.8.2
npm	siyuan	0.8.3
npm	siyuan	0.8.4
npm	siyuan	0.8.5
npm	siyuan	0.8.6
npm	siyuan	0.8.7
npm	siyuan	0.8.8
npm	siyuan	0.8.9
npm	siyuan	0.9.0
npm	siyuan	0.9.1
npm	siyuan	0.9.2
npm	siyuan	0.9.3
npm	siyuan	0.9.4
npm	siyuan	0.9.5
npm	siyuan	0.9.6
npm	siyuan	0.9.7
npm	siyuan	0.9.8
npm	siyuan	0.9.9
npm	siyuan	1.0.2
npm	siyuan	1.0.3
npm	siyuan	1.0.4
npm	siyuan	1.0.5
npm	siyuan	1.0.6
npm	siyuan	1.0.7
npm	siyuan	1.0.8
npm	siyuan	1.0.9
npm	siyuan	1.1.0
npm	siyuan	1.1.1
npm	siyuan	1.1.2
npm	siyuan	1.1.3
npm	siyuan	1.1.4
npm	siyuan	1.1.5
npm	siyuan	1.1.6

Ecosystem	Package	Version


npm	siyuan	0.1.0
npm	siyuan	0.3.12
npm	siyuan	0.3.17
npm	siyuan	0.3.18
npm	siyuan	0.6.1
npm	siyuan	0.7.0
npm	siyuan	0.7.1
npm	siyuan	0.7.2
npm	siyuan	0.7.3
npm	siyuan	0.7.4
npm	siyuan	0.7.5
npm	siyuan	0.7.6
npm	siyuan	0.7.7
npm	siyuan	0.7.8
npm	siyuan	0.7.9
npm	siyuan	0.8.0
npm	siyuan	0.8.1
npm	siyuan	0.8.2
npm	siyuan	0.8.3
npm	siyuan	0.8.4
npm	siyuan	0.8.5
npm	siyuan	0.8.6
npm	siyuan	0.8.7
npm	siyuan	0.8.8
npm	siyuan	0.8.9
npm	siyuan	0.9.0
npm	siyuan	0.9.1
npm	siyuan	0.9.2
npm	siyuan	0.9.3
npm	siyuan	0.9.4
npm	siyuan	0.9.5
npm	siyuan	0.9.6
npm	siyuan	0.9.7
npm	siyuan	0.9.8
npm	siyuan	0.9.9
npm	siyuan	1.0.2
npm	siyuan	1.0.3
npm	siyuan	1.0.4
npm	siyuan	1.0.5
npm	siyuan	1.0.6
npm	siyuan	1.0.7
npm	siyuan	1.0.8
npm	siyuan	1.0.9
npm	siyuan	1.1.0
npm	siyuan	1.1.1
npm	siyuan	1.1.2
npm	siyuan	1.1.3
npm	siyuan	1.1.4
npm	siyuan	1.1.5
npm	siyuan	1.1.6

Find vulnerabilities. Fix fast with AI.

CVE-2026-23645

CVE-2026-23645