CVE-2026-32940: 
NixOS vulnerability analysis and mitigation

CVE-2026-32940 is a reflected Cross-Site Scripting (XSS) vulnerability in SiYuan, a personal knowledge management system, caused by an incomplete SVG sanitization blocklist. The SanitizeSVG function in versions 3.6.0 and below blocks data:text/html and data:image/svg+xml in href attributes but fails to block data:text/xml and data:application/xml, both of which can render SVG with JavaScript execution. The unauthenticated /api/icon/getDynamicIcon endpoint serves user-controlled input directly into SVG markup via fmt.Sprintf with no escaping, returned as Content-Type: image/svg+xml. This is an incomplete fix for the prior vulnerability CVE-2026-29183. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-184 (Incomplete List of Disallowed Inputs). The vulnerable code in kernel/util/misc.go uses a blocklist approach for data: URIs in SVG href attributes, checking only for text/html, image/svg+xml, and application/xhtml+xml — leaving data:text/xml and data:application/xml unchecked. An attacker crafts a URL to /api/icon/getDynamicIcon with type=8 and a malicious content parameter embedding a data:text/xml or data:application/xml href; the sanitizer passes the payload, and the browser renders the SVG with an active JavaScript-triggering link. Exploitation requires the victim to directly navigate to the crafted URL or load it via <object>/<embed> tags, as <img> rendering does not allow interactive links. The fix in v3.6.1 replaces the blocklist with an allowlist permitting only data:image/png, data:image/jpeg, data:image/gif, and data:image/webp (GitHub Advisory, Patch Commit).

Successful exploitation results in reflected XSS executing arbitrary JavaScript in the victim's browser within the SiYuan web origin. An attacker can steal session tokens, perform authenticated API actions on behalf of the victim, exfiltrate sensitive notes or configuration data, and modify page content. Docker deployments where SiYuan is network-accessible are the clearest target; in the Electron desktop app, impact may extend to RCE depending on nodeIntegration/contextIsolation settings. No authentication is required to craft the malicious URL, though a victim click is needed (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory (GHSA-4mx9-3c2h-hwhg), which includes concrete curl commands demonstrating how to trigger the XSS via data:text/xml and data:application/xml payloads against the unauthenticated endpoint. JavaScript execution via data:text/xml SVG onload has been confirmed in Chromium 136. No authentication is required to craft the attack URL. There is no evidence of in-the-wild exploitation at this time, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.048% (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify internet-accessible SiYuan instances (version ≤ 3.6.0) using tools like Shodan or Censys, or target known deployments. The /api/icon/getDynamicIcon endpoint requires no authentication.
2. Craft malicious payload: Construct a data:text/xml or data:application/xml URI containing an SVG with a JavaScript-triggering onload handler or an injected link, e.g.:

   data:text/xml,<svg xmlns="http://www.w3.org/2000/svg"><a href="javascript:alert(document.cookie)"><text>click</text></a></svg>

3. Build the attack URL: URL-encode the payload and embed it in the content parameter with type=8:

   http://<target>:6806/api/icon/getDynamicIcon?type=8&content=<url-encoded-payload>

4. Verify bypass: Use curl to confirm the href attribute with the data:text/xml URI is preserved in the SVG response (not stripped by the sanitizer), while data:text/html is correctly blocked.
5. Deliver to victim: Send the crafted URL to a target user via phishing, embed it in an <object> or <embed> tag on an attacker-controlled page, or share it through social engineering.
6. Trigger JavaScript execution: When the victim navigates to the URL and clicks the injected link in the rendered SVG, JavaScript executes in the SiYuan web origin, enabling session token theft, API abuse, or data exfiltration (GitHub Advisory).

• Network: Unusual GET requests to /api/icon/getDynamicIcon with type=8 and a content parameter containing data:text/xml or data:application/xml URI schemes; outbound connections from the SiYuan server to unexpected external hosts following such requests.
• Logs: SiYuan access logs showing requests to /api/icon/getDynamicIcon with URL-encoded data:text/xml or data:application/xml strings in the content parameter; repeated requests from external IPs to this unauthenticated endpoint.
• File System: No direct file artifacts expected for this reflected XSS; however, if chained with authenticated API abuse, look for unexpected file creation or modification in the SiYuan data directory.
• Process: Unexpected outbound network connections initiated from the browser process after a user visits a crafted SiYuan icon URL, potentially indicating data exfiltration via JavaScript (GitHub Advisory).

Upgrade SiYuan to version 3.6.1 or later, which replaces the incomplete blocklist with an allowlist that permits only safe image MIME types (data:image/png, data:image/jpeg, data:image/gif, data:image/webp) in SVG href attributes (SiYuan v3.6.1 Release, Patch Commit). For users unable to patch immediately, restrict network access to the SiYuan instance so the /api/icon/getDynamicIcon endpoint is not reachable from untrusted networks, and avoid clicking unsolicited links pointing to this endpoint. Additionally, disable or restrict use of <object> and <embed> tags in contexts that could load malicious SVG content from the SiYuan server.

The vulnerability was covered by The Hacker Wire, which published a dedicated article on the SVG MIME bypass (The Hacker Wire). Social media discussion was noted on Mastodon and Infosec.exchange. The advisory reporter (vnykmshr) highlighted the fragility of the blocklist approach and recommended switching to an allowlist, which the maintainers adopted in the patch. The vulnerability is also tracked by Qualys (detection ID 761875) and appeared in openSUSE security announcements.