CVE-2026-34605: 
NixOS vulnerability analysis and mitigation

CVE-2026-34605 is a reflected Cross-Site Scripting (XSS) vulnerability in SiYuan, a personal knowledge management system, caused by a bypass of the SanitizeSVG function via XML namespace-prefixed element names. It affects SiYuan versions 3.6.0 through 3.6.1 (introduced when the sanitization function was added in v3.6.0 to address a prior XSS issue) and was patched in version 3.6.2, released March 31, 2026. The vulnerability was discovered by researcher fg0x0 and disclosed via GitHub Security Advisory GHSA-73g7-86qr-jrg3 on March 30, 2026. It carries a CVSS v3.1 score of 6.1 (Medium) and a CVSS v4.0 score of 8.6 (High) (Github Advisory, SiYuan Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The /api/icon/getDynamicIcon endpoint is registered without authentication and, for request type 8, inserts the user-supplied content query parameter directly into an SVG template via fmt.Sprintf without HTML encoding. The SanitizeSVG function then parses the SVG using the github.com/88250/lute/html Go HTML5 parser and checks element tag names against a blocklist (e.g., script, iframe, object). However, the Go HTML5 parser stores namespace-prefixed element names verbatim in Node.Data — so <x:script xmlns:x="http://www.w3.org/2000/svg"> is recorded as "x:script" rather than "script", causing the blocklist check to pass it through. The SVG response is served with Content-Type: image/svg+xml and no Content Security Policy header; when a browser opens the URL directly, its XML parser resolves the namespace prefix to the SVG namespace and executes the embedded script. The same bypass applies to all blocklisted elements (x:iframe, x:object, x:foreignObject, etc.) (SiYuan Advisory, Github Advisory).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the victim's browser at the SiYuan server origin (e.g., http://<host>:6806). Because SiYuan sets Access-Control-Allow-Origin: * and the injected script runs same-origin, it can invoke any SiYuan API endpoint using the victim's existing session cookies — enabling full read access to all notes, data export, and modification of application settings. The attack requires no prior authentication and can be launched by any attacker on the same local network who can trick a user into opening a crafted URL (SiYuan Advisory).

A concrete proof-of-concept exploit is publicly documented in the GitHub Security Advisory, including a specific HTTP GET request with a URL-encoded payload that triggers alert(document.domain) when opened in a browser. The EPSS score is approximately 0.126–0.161%, indicating a low but non-zero probability of exploitation in the near term. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Nuclei templates for automated detection of this vulnerability have been added to the ProjectDiscovery nuclei-templates repository (Github Advisory, SiYuan Advisory).

1. Reconnaissance: Identify SiYuan instances running versions 3.6.0 or 3.6.1 on the local network, typically listening on port 6806. Tools like Nmap or network scanners can locate the service.
2. Craft the malicious URL: Construct a GET request to the unauthenticated /api/icon/getDynamicIcon endpoint with type=8 and a namespace-prefixed script payload in the content parameter:

   GET /api/icon/getDynamicIcon?type=8&color=red&content=%3C%2Ftext%3E%3Cx%3Ascript%20xmlns%3Ax%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3Ealert%28document.domain%29%3C%2Fx%3Ascript%3E%3Ctext%3E HTTP/1.1
   Host: <target>:6806

   The decoded content value is: </text><x:script xmlns:x="http://www.w3.org/2000/svg">alert(document.domain)</x:script><text>
3. Bypass sanitization: The SanitizeSVG function parses the payload but records the element as x:script, which does not match the script blocklist entry, so the element passes through unmodified.
4. Deliver to victim: Share the crafted URL with the target user (e.g., via chat, email, or a malicious link on a shared resource).
5. Trigger execution: When the victim opens the URL directly in a browser, the browser's XML parser resolves the x: namespace prefix to the SVG namespace and executes the embedded JavaScript at the SiYuan origin.
6. Exploit same-origin access: Replace the alert payload with a script that calls SiYuan API endpoints (e.g., to read all notes, export data, or change settings) using the victim's session cookies, leveraging the Access-Control-Allow-Origin: * header (SiYuan Advisory, Github Advisory).

• Network: Unusual or unexpected HTTP GET requests to /api/icon/getDynamicIcon with type=8 and URL-encoded content parameters containing %3Cx%3Ascript, xmlns%3Ax, or similar namespace-prefixed SVG element patterns; outbound connections from the SiYuan host to unknown external IPs following such requests.
• Logs: SiYuan access logs showing requests to /api/icon/getDynamicIcon with large or encoded content query parameters, particularly those containing x:script, x:iframe, or other namespace-prefixed element names; subsequent API calls (e.g., to note-reading or export endpoints) immediately following the icon endpoint request from the same session.
• File System: Unexpected data exports or file creation in the SiYuan data directory that do not correspond to user-initiated actions.
• Process: Unusual JavaScript-driven API activity originating from the SiYuan browser client, such as bulk note reads or settings modifications not initiated by the user (SiYuan Advisory).

The primary remediation is to upgrade SiYuan to version 3.6.2 or later, which fixes the bypass by stripping the namespace prefix from element tag names before comparing against the blocklist (using strings.LastIndex(tag, ":") to extract the local name). No official configuration-based workaround is provided; however, restricting network access to the SiYuan instance (e.g., binding only to localhost or using a firewall to block external access to port 6806) reduces exposure. Additionally, deploying a reverse proxy that adds a strict Content-Security-Policy header to SVG responses would mitigate script execution even if the sanitizer is bypassed (SiYuan Advisory, SiYuan v3.6.2 Release).

The vulnerability was credited to researcher fg0x0 and addressed by the SiYuan maintainer (88250) as part of a broader security fix issue (#17246) that resolved multiple advisories in the v3.6.2 release. The ProjectDiscovery team added Nuclei detection templates for this CVE shortly after disclosure, indicating community interest in automated scanning. No significant broader media coverage or notable public commentary beyond the advisory and automated vulnerability tracking platforms has been observed (SiYuan Issue #17246, Github Advisory).