Listen to this Post
CVE-2026-31809 describes a reflected Cross-site Scripting (XSS) vulnerability in SiYuan versions prior to 3.5.10 due to an improper sanitization of SVG `href` attributes. The vulnerability exists in the unauthenticated endpoint /api/icon/getDynamicIcon. The SiYuan SVG sanitizer function `SanitizeSVG` attempts to block `javascript:` URIs in `href` attributes by checking for the exact prefix using Go’s `strings.HasPrefix` function . However, an attacker can bypass this check by inserting ASCII whitespace characters—specifically tab (\t), newline (\n), or carriage return (\r)—within the `javascript:` string itself, such as `java script:` or `javascript:` with a newline character. While the sanitizer sees a string that does not literally begin with `javascript:` and allows it to pass, web browsers, conforming to the WHATWG URL specification, strip these whitespace characters during URL parsing before evaluating the scheme . This results in the browser executing the JavaScript payload when the crafted SVG is rendered. This vulnerability represents a second bypass of the fix implemented for CVE-2026-29183, which was patched in version 3.5.9 . The issue is resolved in SiYuan version 3.5.10.
dailycve form:
Platform: SiYuan
Version: < 3.5.10
Vulnerability : Reflected XSS
Severity: Medium (6.4)
date: 2026-03-10
Prediction: Patched (2026-03-11)
What Undercode Say:
Analytics:
- CVE ID: CVE-2026-31809
- Attack Vector: Network
- Privileges Required: None
- User Interaction: Required
- Confidentiality Impact: High (System)
- Integrity Impact: High (System)
Exploit:
The following `curl` command demonstrates how to trigger the XSS by injecting a newline character (%0a) into the `javascript:` scheme within the `content` parameter of the vulnerable endpoint.
Exploit using newline (%0a) to bypass the javascript: prefix check curl -X GET "http://<siyuan-server>:<port>/api/icon/getDynamicIcon?type=8&color=blue&content=%3Csvg%3E%3Ca%20xlink:href=%22java%0ascript:alert(document.domain)%22%3Eclick%3C/a%3E%3C/svg%3E"
To exploit this, a victim with an active SiYuan session would need to be tricked into clicking the crafted link. When the browser renders the returned SVG, it strips the newline, interprets the `javascript:` scheme, and executes the `alert(document.domain)` payload. The attacker can replace the alert with malicious code to steal session cookies or perform actions on behalf of the victim .
Protection from this CVE:
- Update SiYuan: Immediately upgrade to SiYuan version 3.5.10 or later, which contains the complete fix .
- Input Sanitization: If a patch cannot be applied immediately, implement a more robust server-side sanitization routine that recursively removes or rejects any ASCII whitespace characters (tabs, newlines, carriage returns) from `href` attributes before the `javascript:` prefix check.
- Content Security Policy (CSP): Deploy a strict Content Security Policy that restricts the sources from which scripts can be loaded, mitigating the impact of XSS even if a bypass is found.
Impact:
A successful exploit allows an unauthenticated attacker to execute arbitrary JavaScript in the context of the SiYuan web application . Because the endpoint is unauthenticated, the attacker only needs to deliver the malicious link to a logged-in user. The script can then interact with the SiYuan backend using the victim’s session, leading to data exfiltration of notes and knowledge bases, unauthorized modification of content, and potential theft of API tokens or other sensitive information accessible through the application.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
