CyberRota Analysis
AI-GeneratedThe vulnerability affects SiYuan versions prior to 3.7.3, allowing authenticated attackers to exploit stored and reflected cross-site scripting flaws in SVG sanitization. By embedding malicious scripts within specific SVG elements, attackers can bypass the HTML parser and execute scripts in the context of the application, potentially compromising user data and session integrity. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML parser treats as raw text but browsers interpret as executable SVG content when served as image/svg+xml, enabling script execution in the application origin.