CVE-2026-23645

SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file (e.g., imported from an untrusted source), arbitrary JavaScript code is executed in the context of their authenticated session. This vulnerability is fixed in 3.5.4-dev2.

• CWE-79

• https://github.com/siyuan-note/siyuan/commit/11115da3d0de950593ee4ce375cf7f9018484388Patch
• https://github.com/siyuan-note/siyuan/issues/16844Issue Tracking, Patch
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pcjq-j3mq-jv5jExploit, Patch, Vendor Advisory

Published

Jan 16, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23635Kiteworks is a private data network (PDN). In Kiteworks Secu…6.5
• CVE-2026-23636Kiteworks is a private data network (PDN). In Kiteworks Secu…7.2
• CVE-2026-23638Kiteworks is a private data network (PDN). Prior to version …6.5
• CVE-2026-2364If a legitimate user confirms a self-update prompt or initia…7.3
• CVE-2026-23643CakePHP is a rapid development framework for PHP. The Pagina…5.4
• CVE-2026-23644esm.sh is a no-build content delivery network (CDN) for web …7.5
• CVE-2026-23646OpenProject is an open-source, web-based project management …6.5
• CVE-2026-23647Glory RBG-100 recycler systems using the ISPK-08 software co…9.8
• CVE-2026-23648Glory RBG-100 recycler systems using the ISPK-08 software co…8.5
• CVE-2026-2365The Fluent Forms Pro plugin for WordPress is vulnerable to S…7.2
• CVE-2026-23651Permissive regular expression in Azure Compute Gallery allow…6.7
• CVE-2026-23652Improper neutralization of special elements used in a comman…9.8