Executive brief
SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183) in github.com/siyuan-note/siyuan
Affected products
- Go github.com/siyuan-note/siyuan
Junglewise Threat Intelligence
CVE-2026-32940: GO-2026-4721 - SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for ) in github.com/siyuan-note/siyuan
CVE-2026-32940 · Severity: low · CVSS 3.1 · Published 2026-03-26
Technologies: github.com/siyuan-note/siyuan (Go). Vendors: Go.
Related threats
- Duplicate Advisory: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw S
- SiYuan SQL injection in fullTextSearchAssetContent endpoint
- GO-2026-4708 - SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes in github.com/siyuan-note/siyuan